{"type": "bundle", "id": "bundle--1db40f35-76d0-4f4f-9f87-b782e31a4e25", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--ff5c947a-d0d9-4ceb-961e-e39660c8927b", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--8e917b74-d922-475e-83a4-4dd070957185", "name": "DigitalOcean Toronto", "latitude": 43.6547, "longitude": -79.3623, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "CA"}, {"type": "location", "spec_version": "2.1", "id": "location--42c5af1d-44da-402f-a38a-19e8a63336ab", "name": "Vultr Melbourne", "latitude": -37.8136, "longitude": 144.9631, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--26d62335-a589-46f2-90fe-b2f4122ff7a4", "name": "Vultr Paris", "latitude": 48.8566, "longitude": 2.3522, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "FR"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--81f40b9f-fdda-4c1c-8a62-7b5989d7befc", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--973cb92f-bffc-4a33-8140-77740499f657", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--64957529-1521-4659-a7c9-956a03aca469", "relationship_type": "located-at", "source_ref": "infrastructure--973cb92f-bffc-4a33-8140-77740499f657", "target_ref": "location--ff5c947a-d0d9-4ceb-961e-e39660c8927b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--b501643e-da80-426e-a72a-91f70b2bb930", "name": "DigitalOcean Toronto", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fcacf5a6-a06e-4bc7-a965-82b74c9ff321", "relationship_type": "located-at", "source_ref": "infrastructure--b501643e-da80-426e-a72a-91f70b2bb930", "target_ref": "location--8e917b74-d922-475e-83a4-4dd070957185", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--0d0ef221-971e-4b12-9c69-eadca6b0025f", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--0d2f7eff-fed9-494b-bd97-deaa04b8c71a", "name": "Vultr Melbourne", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6365f841-5b4f-4d52-b2e2-2f1aa9c203b9", "relationship_type": "located-at", "source_ref": "infrastructure--0d2f7eff-fed9-494b-bd97-deaa04b8c71a", "target_ref": "location--42c5af1d-44da-402f-a38a-19e8a63336ab", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--64aa4826-33d8-4ef9-a34c-9b2e366f4aee", "name": "Vultr Paris", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--504bf07f-acb4-48d6-84eb-53f6cef9016b", "relationship_type": "located-at", "source_ref": "infrastructure--64aa4826-33d8-4ef9-a34c-9b2e366f4aee", "target_ref": "location--26d62335-a589-46f2-90fe-b2f4122ff7a4", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--a6c040ac-6f84-4fdb-8d15-d4cc1d790d41", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--e77df12b-61de-46b9-8f9b-1865b3947d37", "name": "CVE-2023-1389", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc093854-7f7e-4c52-baef-01db96f2549e", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '/>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c61e1e4-a02d-48d1-b76f-40b4a1410bee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.15.52.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e913fe2-6f1b-4d16-a898-6834859b38cc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.169.195.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d14aee-87f8-4808-b18a-4e2a8d0705f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.206.55.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aff757ef-6429-4aa3-81cc-aadffeb52376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.24.16.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62197380-5f67-4039-9626-bd80f711bd2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.24.16.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5698bfd-4cdc-42ad-93da-8188e67fd9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.250.22.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6c9ccaa-3773-4077-9f9d-1f797ca45553", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.53.229.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce65315-0713-4f65-8214-918a868806c5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.53.36.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--863609dc-1bcf-472d-838d-4d67155ec519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.64.106.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--497331b6-1054-4ca6-83f8-c5275f467d7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.28.153.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e603e3-bfb8-41c1-9ee0-fd182d37218c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3211e8b1-f546-4e71-9abc-9cc915d39055", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--381a84c4-d215-4833-aab7-501874e7e855", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc7cb96b-3820-4d77-98df-32b6d5d87318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c058d9b1-0e5d-4c42-9b59-492b0e00c813", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb4df340-4545-499b-b31a-5d6ad1d38c2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f80a632-216c-4d57-ad8b-0997d9f9d5b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fff33c3e-6ee9-40bd-9710-c9dd3dc130c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b8be35-ccce-40d1-8db3-2cac92cdda74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6858474c-a3f8-458b-9d37-b1a690d09e14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d98a78d-1c0e-4e2b-a3f3-923bf5844914", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2bb063b-8f44-4482-bfd3-e3ea973c498c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cec838-8fa5-44ca-a401-b6d48ede7af1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da5d2319-b6c1-499b-9063-e010afd2bb9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566f79e3-5a1c-449d-af61-76b96d64b2f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31773f2f-d952-4553-bb2f-71f9ce1ccddd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da7e822-3ed0-4aee-9119-66e9f6466a01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fe071c1-6026-433f-bd6b-4a7577cbb2f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc358ddc-8377-4a30-b4d9-a81a55e109d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e0edc0-2a1f-4d3d-bf32-87d373189039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.29.192.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19e53345-f5a6-4d1c-81fa-070ec22c211c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.117.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d57a9d5-bbbb-4cdf-b93a-8b58ff1435ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.17.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a294924b-e032-48f9-9423-c4e94b9fbd64", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.54.149.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ffc20a1-5645-4c76-bf82-72f65037b714", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.64.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea99784-41d6-458c-b001-f491b3b050e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.126.81.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc3619cc-a05d-4e9f-9953-481a32ee26b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.168.34.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49202eec-fe03-4c05-bf3e-68e0c531cd45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.206.108.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25f325ec-2fde-40b1-bd0a-8150035c7c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.105.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4746e59b-e480-4286-8176-9addc70227ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.106.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--267304db-df16-405c-a79e-75afdb24a23d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.107.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cec5188-a635-4c18-a162-6ff023b9ebc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5634d5a-7991-4767-b502-893cac123863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.108.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ceff63b-1b87-48e1-bf76-694b47e4414d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.110.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db01549-953f-4b73-a76b-6eccb074cac5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7606a0ab-ebc0-45ae-a4c8-6edf74c4dcd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.114.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e428cd5d-a207-4103-a70b-b1781c2e63f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.117.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e03cd791-b158-4e13-86a2-d8670c6ea56c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.118.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c77dcd-f7e4-46f1-9a5a-2af925fb5e8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.119.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--076d5227-4172-41ea-ac4b-940b72270546", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.121.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c751457-bec9-4b12-8014-6bfb408682fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.122.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77052d8-5849-4c41-8fa7-e53b7567e1fc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.122.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06483a39-ffcb-48e2-9ef8-3758c23b5ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.123.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7add1621-ca5a-4c36-853a-e472537ade5d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.124.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1429797e-1700-480e-93c8-1d155c0c5c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.124.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44638c5-8c1e-4ff6-a48f-dfb3f2875bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.127.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e11fdd77-998d-49ae-b876-6fa59f0cea5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9f7c9ef-0fdd-4122-a15b-7c1aa0e9f56e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63d33ba6-86e3-44ce-b83d-0ad472ab69cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.36.97.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dba35d7-76e8-4f17-9743-877251ce880a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.42.93.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341c70ac-2d36-47a8-9ed2-ed156296b24f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.155.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58f848cf-b7ef-4ed7-98fb-c7d1d990d304", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.158.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827935f0-9323-4912-9a82-30531fef00f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.67.139.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1136bad1-65a9-4aa6-8bd0-672f93b2c670", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.79.165.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f3a483-199b-43bc-a289-5f46f165ed68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.186.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6441dab2-5a2c-4b14-afdd-ece56fce605e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.200.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eaf2d1c-fcaf-44c2-a0ca-12de65f9b869", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.140.97.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa63467e-e49c-4e74-b023-cecfc4303501", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.210.149.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03aa641f-8f65-402f-b3d2-dc92757fef67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.219.170.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ff88ec-0b5a-4ec6-a5ab-194a583ec5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.69.167.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e1dbca7-9c8b-4080-b539-38567cb02bb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.21.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8f5aa3-5bd7-49d6-977f-e800f02c4c2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.1.210.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b2db0ee-0d6c-4911-b93c-f6dee6e1f940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.103.133.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b41c366f-6fdc-41af-aa32-b372d73b06c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.112.62.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6731015-d5ad-4109-b2d2-df04a19987e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aea3364a-0664-4e41-a848-3600b575a392", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.123.226.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d4f9fca-95df-4c6d-a716-116f14754352", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.126.117.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--233468c5-8249-4e1d-b745-b6bb47c7026a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.13.206.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a0c123b-0da5-46d3-baa4-4c036d250a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56ceb7b1-87e9-45bc-85b5-7f70e11867c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.14.32.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4451e090-0cb1-4f38-bff7-3eca47acce26", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.143.231.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c6068b-aba8-43f8-bd92-120e17fb6289", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.23.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac47798e-386b-4cb1-bff7-efdb609f9459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.149.26.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb29213c-08d9-43e1-b892-173f4b88ee7d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.158.53.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6937b36a-bed3-4570-a226-d770431a5611", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.158.53.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a4a7d8f-b8d9-4f3b-843b-bc9e3396765e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.158.53.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95ecf8f6-e4de-4986-b9e1-f5f1ed04bbec", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.158.53.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3087cd-2d83-44d4-a05d-9a38e7460088", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.159.54.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3716389d-1bf6-4da3-8926-58f650371c2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.173.227.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24257e58-9843-4aff-9f7b-1041885df4d0", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.174.50.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2734db-0db6-4ad9-97f2-0f1973bfdec0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.175.225.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ab36f8-0a8c-42ac-8e18-a8dd4c727b9f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.147.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f391d24-a498-4d93-9550-d11b05cebbbc", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.187.26.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c52a63e-2ea2-4a79-a1d2-05b7a896ec76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.195.100.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08caf020-4742-4835-9231-0183315066f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--643d77c1-70e4-4203-9433-8a7e0b772c21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ac32509-5fbb-4663-9ace-eea40a9cdb86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.203.57.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d599394d-ca66-4605-8bf8-c177bcc69aef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.210.22.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b06a27-ca53-4b0b-9bf6-882073b68a66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.210.22.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05e2c381-af24-4c1a-9b26-3da4a4b2c06d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.211.59.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db91773c-a80b-4036-89c1-2fc6d223011e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.214.5.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99a89027-8d87-427d-869e-5ade429e6e64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.215.74.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d41f6c5d-4b43-4022-b1c4-0689a84671f2", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.217.154.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcf7302-ffbb-4567-8962-f3c066a408b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.217.186.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5013b0-ee37-46fa-b735-737dc4e3af28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.219.170.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b43bfc6-8dee-4896-9f20-115ce698e50e", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.228.144.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f6ac1c5-9fda-4af8-a1f9-1c6410e69c0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb56654a-3e5b-42c8-942f-83722eb845e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f9e02e3-98ff-44fe-b489-ecf05f9d13fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3efee99e-101a-467a-abe9-2a7571b85151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39a1d8c1-553d-4f64-b5a1-f1d8ed0b0e88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00ebbf09-a1ad-4b8b-8bb1-d5c74d9a86ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9f6a35-91be-4166-937b-6813355d27df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9952bc90-77ef-4088-bef6-6dde1cc2919d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5160b2f4-fbef-4ba1-ae0a-30001166c22a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb6a1df4-949b-4240-84da-22a365af2aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a2d69c0-4ac4-4177-9f81-4e112dc9d475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90474ea6-db42-4a1f-ba61-6e5ec2ab15f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4edc966-a323-4fe4-9f54-099d98bfecb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70a221a6-7867-4fd3-95f2-8017d1b1af51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.62.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df11101-4189-4971-97ab-9e720a70e485", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.244.172.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cced9428-85e0-44e4-8ee6-744c8764eb42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.245.71.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddec59f4-524a-47e7-abf6-ca6c8e7349dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.247.13.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d6f8488-69b3-4c6d-a4db-0edd6e618428", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.248.121.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a123d31d-8010-496a-9dba-72fbb256f06f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.3.164.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ae651be-f122-4227-b888-ec1082d9c61f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.36.221.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca22f191-883b-4d3d-a66f-0467e702c356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.37.6.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0fb121-19e3-4777-8615-a655a02b92c3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.41.247.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdffc907-d0a5-43f6-8fe1-c4e454762e58", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.43.8.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24351e21-f92f-424b-ba92-da13c0886c09", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.52.153.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f0fed7b-445c-4b87-90a2-5b56069468dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.57.248.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e5901d2-4d69-4548-b8eb-c2b1caba0cbd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.63.108.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda76c85-7fa8-4389-bca4-b26c93922998", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.64.129.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--622aa0e6-1890-44f5-bda6-0dd02c550d5a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.65.240.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37b20257-fffe-4b5e-8dcc-18175b40df6d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.70.40.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4da37ecf-65de-4950-85e0-c71e44d1f5e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.77.246.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5913ad4-f3f3-4d6b-bfe2-d8f79e964b57", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.78.1.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a2749b6-dfe6-4b62-90cb-48e39550c762", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.85.66.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--921dc3e3-40d4-4c34-9806-a80cfd43d912", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.86.198.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bafb4b5-1fe2-49b9-8e12-4d79dc57c44b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.9.204.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a314548-8513-4835-a8a0-79f2add9f229", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.91.246.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1edeeddb-457a-4a2f-93c6-45250e09bd03", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.98.176.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228166fa-de1e-43ce-8125-a459f6bbcff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.131.69.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--780b9e8e-2f46-48b9-a68a-fc709b71b8e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.140.148.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95df311a-9dff-4617-8232-983811fea1e5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ad1613-bfa8-44c7-8462-b597c5aee614", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdaba7a8-2370-4bee-9ab1-c8bf1222d075", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e7e76d-50c4-4ef0-8ecf-2f9f811f580f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74049a0a-4791-4ad8-a801-799f83384031", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe3c00e-56e5-4909-9e08-fc6ec941c311", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.152.52.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c72a3cd1-34ad-473c-baae-4b4fbf589cec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.131.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecd9e09a-726f-47d4-a23f-7b6f4aebc4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.32.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe3d417-c73b-4cd7-9456-fb812cee64ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.70.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2595497d-3273-41ea-a43d-894247ca45e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.155.83.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7eb91c7-88ed-4279-b422-46b2c93ddf47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.156.52.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b82125ae-df0e-4771-9f68-bae27e577dc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.167.64.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09dab221-2e6e-42a9-900d-e0d13a4f34c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.10.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a9fa29b-4e9a-4ecc-ae16-31e92144d1b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.194.9.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06f34284-010d-47eb-b869-71e51ca86800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.225.143.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c496ee9c-e242-4446-a9fb-f065136339dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.232.79.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e69293-bf93-49b5-9057-c24ef501a6e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.236.97.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b48fc40c-2623-4238-ae79-328241e1f52b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.147.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a14d74bf-ccc2-41d2-aa7d-7347eadd8993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.156.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc2ec01-a534-4c8e-b2bb-32e3445aa24d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.237.57.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e18c86-c9b9-400c-984c-e24ca59ebf9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96abbaec-aef4-4465-913c-3511bef8aa0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.35.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2022dd3-5e88-4967-8108-4d7fd677f7c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.243.38.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0aa81ccc-1209-4d82-b857-8d114f787005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.207.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3adbfc29-3e49-4db9-af18-44c6b89b96a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.22.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f893babc-2b2c-497f-800f-9d4d03ea6f74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.251.180.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38540658-55c4-4a80-ace6-789cd8e42146", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.195.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ef7334e-8e59-4912-bb3b-b7a6b42c50cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.116.9.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08202778-a65e-4ec1-861d-4224682282ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.68.242.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b10e6f8-0d7a-462c-ab82-83acfb46256c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.241.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce8bf491-c406-4664-860f-5e537e917f6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.201.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4826fa5e-84a6-42ed-b732-f55f507cdcf3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.69.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5fd47f-d574-41db-973e-d55f50f13d23", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.13.98.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d09f57-dbf2-450b-900d-fa087beb15c0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.200.5.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a2b157d-ab70-4068-a13b-ad7c2cdb7ae7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56bc350-1c82-4356-a570-70cb68c98764", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2f69f15-f6a2-41a3-b207-387202fadd33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4fee66-ca45-482e-8c9c-9d470666936b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea19aed1-e327-484e-bf54-21c5b547e44e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--319fb87f-572e-49c3-8c2f-0f3a04043481", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de0b3804-f3d0-49d9-ab8c-30e5de2256d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bccb6c23-351e-428d-8f91-79e613f5e4b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db997af2-aa8f-475e-bace-7e95b18651f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b772cc0-8452-41c7-96b0-fe03b8fb1804", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4bba1c0-331f-42ac-97af-3f5741496e7a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.63.26.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757e7bb6-1fe9-49db-97a3-283e8ff8e38b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.139.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6405f366-07fd-4c56-a0a1-1d4d051d1ac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46538332-69c7-423b-9e70-c87b7acf4363", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.144.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de60d594-ec27-4379-a434-840e144a2a79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.172.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--933e89ef-ec5f-4fe1-88c6-a5a389a527d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.176.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16211ca3-a925-4014-a26a-8fc8efc2f0ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.189.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32978a0e-36bd-43b3-b5ce-8d653c2fe905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.191.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f840cbc7-316b-4271-a6f3-0b9fa3be0562", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.191.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4eb21b8-f3ec-46d1-a7b2-f1119585971e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.75.25.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebb5940f-88eb-40bb-90d0-6938a081f2f1", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.0.200.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--759628a1-3107-4c1b-87cd-9d504edf787e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.144.141.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803076ae-1547-4bb0-a58c-241cbbd75c85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43bdd3da-f31e-4f9f-872a-7733846439ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c88fcf57-b895-41d8-829e-2d5f1388a8a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.100.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fcf97f8-5ed6-4860-9e06-da5891214ecb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ca5130d-3fb4-4d22-a0dc-e193e023f0d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d45730-5b9c-4232-b1be-a3bcda819050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.101.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629aef13-45a7-4ae8-8493-09e7037d4bfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b17f48a0-371d-4d0f-810a-fbaad59c0b8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c4d175-7e59-4451-9288-b6c7e207e48f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.103.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fff3a4d0-ab30-4efb-99b8-ef7a5e2e1757", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.104.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--545b26fe-976a-4ff3-a6de-b2e9db063135", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e49f976d-04c9-43ab-928a-c142b063cde6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1acebe-6a02-4817-8535-f0fab3294e28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.105.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4169428-14bc-4d49-aa6b-5d007d3c9297", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.106.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec6e6b07-a55e-4916-af51-6f72b27480d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.109.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bae6de-977d-4097-91d8-64a6509bd03f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.110.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5af5ca2-5221-4546-a6aa-02dc84efedee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.111.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bfbab64-2b53-46dd-9469-20532d943ade", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.112.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b484ffe-96e3-4904-880c-3fd0cd10cecc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.117.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e674bca-f3ed-49ee-85d9-af701a0bbd02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.146.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2897a4f-24c8-4e5b-8b9c-d6b5e6bca648", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7ff59b6-896f-4a52-a61e-4e2866f79697", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.96.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aedef478-f1ba-40e8-aab4-9971e0e9bae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60bf0b37-267a-4870-a312-e0ebf2c5fbc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.97.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f74a8ae-ac9c-4739-87cd-dbd1d1099219", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--495aac09-c29f-4832-b15f-57828fb16b0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d62fc65-8749-49bd-bf49-301959f61a37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.150.99.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a02d226-067a-4911-8f60-4ac389136731", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.155.56.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba09744-51cc-4486-b624-4aa6d60059e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.247.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--378984bb-77e0-456e-9f5f-e45a024ee50f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.170.53.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3970a27f-e44b-4de5-b2f2-059e40308763", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.172.204.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--829c67ba-7d30-4946-aabb-1dd354e98d28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.175.53.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c5fa97-fffd-4354-b9c9-3101fddee7b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.189.25.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7282747c-299e-4f2a-9c46-d34a8883d7cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.6.182.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45b4a915-60ce-4396-98ca-4408c6552766", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.175.164.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83a4bc1f-a54b-4933-93a5-c7a38c4c4ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.6.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8577e6c-93bf-4bac-9b15-e5ef14557443", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.181.63.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84fe7d4e-4744-4faf-a2fd-051c5e442c36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.41.254.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b486a1-3532-4623-807a-78fad5542bfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.61.198.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aff2a80-df1f-4f14-890b-20a780569555", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e141481-6566-46a5-97c7-72a9c964d9aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054793fe-0571-4d82-9b15-78044e4db5e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.209.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05cc3ffd-b6a8-47c6-9a07-202d9390da01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--679b8f94-9737-430c-ae52-f53218026e50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.210.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c422c11-ab52-44e5-8a03-7658cf6d51d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.105.211.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5d18a8-e652-4e09-b721-14ccb132cfea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.123.229.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca781089-34cc-4bde-aab6-ceb7b695d4bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.224.6.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48cd78a6-ee4b-47fd-a7e4-db4c91dd957a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.236.86.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb1ce2a-d792-4bc3-bca9-884d0d761fd0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.49.23.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28051181-35e6-41c3-ade9-366183b3d9ca", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.10.176.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e8a67c7-4411-4ea4-806e-b8bf9512fc29", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.10.176.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13cac14f-cae0-4947-9415-28b07b8bdd88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.113.89.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308adbbe-c670-44db-9500-ad0b1cf262b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.119.236.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97b49bf8-ee89-468e-a31b-7d685f0c6f8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.175.88.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--159bc51d-168f-4fbd-aa8a-01aa4e4c056a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.30.98.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02ffc2c0-4bb3-492e-ba63-6eb351fed1a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.36.57.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51385827-a7f6-46a2-a734-cf11f5dd2ab9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.59.179.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8adde9ef-d520-463d-b940-a5a013882788", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.102.223.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691e5536-969a-41cc-b78a-42e763a2787f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.102.87.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035b3dfc-f05d-4731-8506-c04931787fcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.105.1.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7976e06c-d77c-422a-aaef-4beee9b7d5f0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.151.178.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1a4f92-a8ed-4f84-a626-f45939d064a4", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.18.119.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d77d1520-3dfa-45f1-9768-b50c270f1cb0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.217.188.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb3f84a5-8442-4c53-a777-271771521c55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.212.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc4fa28e-6741-4518-af5d-8dfeaaed48d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.212.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ef83e9-ab3e-49ff-b4fb-0699a1792c50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.213.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c25e9fc-3fdf-4fd3-8ff5-e663910fab2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.214.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c230e7-7782-4c70-8c78-86baa5c4f065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.46.214.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c33b5093-6f23-4e24-9e85-30011de04c71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.65.211.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd5adba-bb98-40df-9052-6f5e30e1dac6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.65.211.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b18f0ae-49a5-4076-a141-8b5a7671a381", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.12.37.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc58d12-d906-4fb2-9d68-aeafe04db2f0", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.128.205.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdd635ad-b91a-444d-9e91-35d5693ec668", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.160.82.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ed0120a-f55e-4ea4-b235-fdc042f5e7bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.182.122.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9d7f6a8-b1f8-49b0-974c-a35dc32eb1e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.214.18.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a85a070a-2014-4181-af7d-13c4b89d13f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.225.128.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ddb3df9-2a92-4b9e-a318-ba5895fe4832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.31.107.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3eec5b74-2843-4038-b770-a7b9da048ccb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.44.124.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26d523fd-2735-4700-8b8e-8212abf08006", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.44.96.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f68866e4-308c-490c-9ccb-604709eb6cfb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.45.39.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d7e107-f908-406f-acce-39be20863b70", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec37022-3a25-485a-b956-e018a6daa556", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fe922c4-2084-4718-a1c7-74934ee70d8c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bf6021-6e88-4262-8fb1-55993baf8924", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.132.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c454f4-39b5-4416-94a4-4b68201b8127", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddb8e3f-c4fd-40e6-81fe-69a6c1cae019", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6056ca21-58b2-4988-bf4a-437f92d037b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.134.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f69b0283-4cea-43af-b1e6-588f95f47212", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c768f69-e93d-49de-b2e5-09beacee035a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d773b5-33a1-44fb-84a3-3b9a733a5ccf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3f58789-0c21-4097-ba09-7cc9c1729505", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9898ccf1-db1a-438f-8432-36bdfe4c456b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c3e741-5108-4efc-81a0-6d3d4ecee268", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe1b8a55-c22a-4964-a24e-581ff78e69e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b0d261-0326-4d40-b224-e31a47c58a36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a06eebfd-79ea-4254-b485-b0244dcc9b52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ece286-812c-4390-89d2-00b7208f7d4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb96875-d012-4002-9790-5112ff146a08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed47837e-180d-4726-92f2-c00df78dca11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1745d91-2af9-4394-a7e1-22b1ae368f74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5af7c847-a9c4-41ce-acba-9651b79629d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ba188ed-0502-43e4-b449-25a849bc7081", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6bfc93b-1b36-4759-92f2-f2665908c8b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606733a3-b84d-47ab-b9bf-6cbfa5b576d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.146.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b2a2d2-3718-43f8-97c4-8f7185277918", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f116de06-c22a-45e9-8f77-0870cee77d8e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46348572-ce7e-4ad6-9c9a-922e5bf7b33d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d51bad4d-a50c-4e58-8136-f8eb286cdb01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--544255c7-ecaf-4269-882f-a4e84963b1a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ea13112-7099-48ef-b039-877ae35d6a61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d9ae7f9-a6bf-466d-a281-d1604844750d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4e5da1f-5554-4412-93ab-4108ec74b210", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.154.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f33f135-5b07-40c4-a929-0ff4219e09bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1279af4e-7631-4a26-8c71-f463faeb4919", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--864b4c82-0d95-4ce5-b0b9-b5dd0ead2198", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba986867-c04d-4eb8-b620-663da278171b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.158.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b5617a-a313-4a38-b64b-7bff98164e49", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5b07ab-6371-4f1e-8116-8762e39ab873", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00b6790c-fbea-400d-a4f1-82a86773ccff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.143.121.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd5c39e2-c180-4fb6-a180-8003d15424c5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.33.213.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ef72e77-958a-4529-ac1e-460b34c0a45b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.33.228.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--564626a5-b235-4af0-9932-e799b9ee70a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.146.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fb6f59a-7e5c-4e54-ba02-8ddce88fca1d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.35.184.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ef7f57e-228f-4d0d-b333-db1c9ae28305", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.36.97.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0909e8-568d-4887-bd1b-1d0da013293f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.97.190.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c153c4f-57b2-4cea-9f2d-b6825c45667e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.98.230.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34837e2-e79e-41eb-854c-b9d156e8f1b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.113.145.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85da7d1e-84e6-498f-8712-964796c72eac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.126.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25be016c-52e5-4151-8330-c66dcdf10904", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.166.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d6e1ac0-7d22-4704-bafc-ab544bac0028", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.172.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--149e1e3e-ae6f-4069-96ad-ad63d4624c23", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.181.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd5d12e-aee7-4b58-9ba1-3de2d8c2202f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.192.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62f076c4-0449-431b-a304-967cbf20a0eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.197.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08319d5-fe2a-472c-9e97-a4561aaceb29", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.211.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ade067-1bd9-4129-bbed-9e92f85e45d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.198.219.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77e91082-923d-4886-9d8e-bde264359fd9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.212.21.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1200051b-6499-428e-9c55-bd346069b257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.215.167.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9ce61a3-c926-49b3-a70b-1ab3cf4213d3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.220.185.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b764da-1c7f-49fd-8c8d-2daf4ae4d8d4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.23.6.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7b2e49-ea28-468c-aaa2-cc79ac24f013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.42.75.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb4b463-d18d-46b8-8b77-c15af29689b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.68.226.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62404ff0-93f7-422b-99cf-9c910ee224ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.178.129.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd8406a8-9c7e-40a7-b28c-ddad0af0c1fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.178.130.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0477dd13-5eb0-4787-aeae-f280a158decf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a632e6f-baba-453b-a291-34d0704ff8e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb4e3bb-74b0-45dc-9814-1b3a29a7d1c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.204.151.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4427b89b-32cb-4b35-8163-84fda1795fcc", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.207.113.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d45c97bf-73b9-4f6f-b85e-1e3620adf3e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.248.172.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37ba7217-5711-437d-bdae-d1b3a01a18ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.7.254.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18792a2-69cd-4c76-991f-676049b55713", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.92.229.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a83d9c4f-4a08-4ddd-b549-eb917cb33e77", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.123.245.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--707cecda-6f45-45bf-be17-ff930b3eb66b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.139.231.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e37510ba-07b6-4483-9051-bd20ac5e62a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.175.140.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b43ec52-737d-4291-8988-1844392a2c42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.24.13.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6801798-2685-422b-9691-223d9c976b5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.247.251.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--557cfb00-641e-475d-9111-cd16d8391e6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.35.207.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--366ff03a-bc20-40e1-b208-5853a05dd0f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.41.181.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c0c62a-dcbe-4de7-9c4d-bc6926588bac", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.186.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eabd883-7f5f-4c01-b77c-118cd1a92b8c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.62.203.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d0c2998-e460-4018-a1b4-2c7f2897367a", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.80.234.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c5c1ea9-a521-46ab-83c9-78b76e6fb946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.89.245.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d31b8010-6c23-47fe-b0dc-e9e9eb7151ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.139.164.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7deeaf6-fbea-49a8-94f0-233d3992dede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.139.167.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaf51824-78c5-4e0b-96fb-dd78ed46360a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.182.166.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76385c3a-380e-4d76-9b12-7086de0d010d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.186.7.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f8d79cf-3060-4c07-b10c-425cd1cfcbea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.186.7.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af28da74-67ea-4d0e-96ef-2f65bdd84bcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.32.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b3c77a-a5cd-4dbd-a1b8-88a67a67cda2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.35.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c09f80-6ec2-4bf1-930d-a7e0137315f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e3e3820-49f8-48bc-848b-a1f5a006531b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.36.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95f79c5e-2b6b-4fc5-bd69-386208344332", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.38.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e53fe6-3972-4e3f-a662-e7c2f8fb77d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.43.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3923c44f-5949-4b5c-a128-1ff4c44ddeca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.44.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6506a12e-bab9-470e-8980-2b8722e22149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.45.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5bc2567-d60d-42df-8520-7f35e1bbc1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.47.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb26891a-ed46-4cbe-9f57-a6f7cf86a0ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53f094e8-ff00-4a48-ba21-879188c28a65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1527d808-f171-4ac8-9c2e-55b08af6863d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9ce4b7-83a6-47c1-a774-39f834b7e248", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.56.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0679a38a-1807-43ce-bcfb-5684e64c3dbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59893d6e-6e6d-47be-9889-543fd6cd8627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f33d86-79c5-4a48-a502-f9e87d00fb05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9cf763a-0037-423f-8ed7-8b713c2a5f31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.57.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e407b68c-9e35-430c-8c49-a68827817f7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87cdb844-2760-494e-b48f-234dfbd9d3ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.58.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62965e43-8618-42f1-a79f-a459005863cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--143cb072-c1bf-4c62-bb8e-d985e9eb1990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df1d5729-c434-414b-8130-9563795d6204", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f225daf-ea5e-4bfc-9722-082388b1a284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.59.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045e877a-92b8-46ea-8e75-ac561f1b65be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.61.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dae53260-15db-4d64-8444-ef5b8aadc9fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.65.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b1ff0d3-2c9c-4b88-9a21-ed186b0d90cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fe55a7f-0e45-44f9-93af-b6c18ca14022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.69.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--186241a6-c086-4199-986e-67e2ab4eb0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.72.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d00a1f-0aa4-4196-8ef8-9c07b5368536", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83408773-2526-4811-bbfa-2a62c36f99ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0629ad3-971d-43e0-9994-6aee90bd5cb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.193.77.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3075f027-e3f0-40ed-b9dc-1380371b436a", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.228.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--414511eb-e2ef-4cde-8146-f4ebbf04d1a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.233.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de17b854-67bf-4610-9f0e-7f5d95280043", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.234.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a14b355-0379-445c-9151-b648b25b3531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.235.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e4b954-babe-4d7d-840e-0f585bbe987a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.236.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--508e1853-ee16-42f0-bdd0-c93194a5cf60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.248.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2237256-5489-4a50-b4e5-d5bf1dea001c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.249.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39ae670c-f264-4b79-8753-2c4b33667f80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6351e290-6a16-4f75-b78f-e274533e85ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab65163c-9381-4222-9765-b5b63b39fe8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--314020af-7167-4060-b113-1f213d96760d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.250.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c8cc5fb-3fb0-4ca7-94b9-4ff86074c9c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9edab80c-92fc-4c2c-b6aa-62aaeec1bb58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4440fe84-f016-46ab-b84a-15e71929fdc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c82ae1-054b-42be-b0fc-840df99f08c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.194.251.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1333e324-06ec-4a66-b51d-9b740a2fc601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.196.56.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66eb516b-fd66-439b-9b15-71be30497848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e9a2bd9-58f6-432a-b1fa-28eeddd77da5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d4fe527-7ab8-48f0-98d0-c6b80ed2ac7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.105.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--838df59f-8e5e-4428-9707-65e701505f01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.109.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d372c8c-4b78-4c5c-b771-6ad0c6be73cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.26.38.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b61704-f508-4719-a9da-69a79e52b1ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.70.178.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f3fc95b-2fb9-40bc-9d36-5e7b48fda064", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.100.144.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85aa5284-c45a-4ce6-862d-f34b571076f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.152.228.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9941316d-d11f-423d-af59-ccd8c74b9c5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.154.53.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d894ba6-3085-4f7b-83eb-ec24ef1af9bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.157.76.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21407a89-598b-4a72-9876-01760e2ad5ae", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.184.181.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52bbc9ec-b914-4441-9d32-739073af8ccb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.193.230.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5763b730-11f1-41a0-b023-e0ee78351e90", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.235.92.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--211caf30-b809-41f2-947b-f6dd30026e5f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.249.100.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3786b54b-20a2-41ef-aba8-43a4a42f4754", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.177.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa5c9b80-9a90-4516-97e6-be1fc167a1c3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.114.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bac1dff-2e4f-4724-bce7-51e011e54ebe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.186.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--706f7a4f-ef08-452f-8833-0d2b2354e387", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.99.165.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09efbdf0-9a08-4a2c-9979-314fec264ee4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.138.6.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df2fb75c-873c-413e-8c68-22b5876df864", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.211.145.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a5c9ab9-58c3-4331-8d43-186ee8258097", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.26.32.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf55046-8a6f-4bd9-9d0a-aaf07a16355e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.144.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8188fb42-624d-4a8e-b000-6414ecbd2975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.32.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b39190d-64ea-462b-8de9-fb388fe14119", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.162.19.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--049862d0-96da-4aa0-b89c-3a6a278fdbb8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.170.136.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f713cb8-1ce2-4062-b4a7-e42023687e34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.171.125.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--796b43a8-591d-42ed-8ce1-90fd9eb9575d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.40.210.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77224eb2-93b4-498d-a9de-f07d57642108", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.40.84.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdf0df90-c5c0-4494-a47c-733ef1be49e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.41.221.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fdc5561-d2c6-4561-9953-5e5cab71e148", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.43.178.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b99d1a3d-6c89-4ef0-bca8-aa2620042825", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.114.241.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f60e3600-4098-4cc8-a1ad-5d458adda1b4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.117.188.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf29fa62-6f5b-4bd2-a3dc-6762c6951fa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.117.225.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d54d3d69-1a47-417c-8c07-a7decb51baf1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.118.206.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32066378-bed3-4fbf-b9fb-b44336ba4024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.234.179.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ed5e6d-5008-46bf-a5a7-959ce7aa8065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.130.18.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde3c00f-8e2d-45ce-bc2d-ef92975cfadd", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.157.223.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc634a1f-fede-4062-88f0-6f248d16edce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.178.210.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ee737b2-d9cf-4b26-8cdd-56d4c84b4adc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.180.182.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cd5d277-bb26-45e1-990e-f97610040e6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.207.35.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62399a1b-02ea-4010-8e89-c27ccf364b99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.57.67.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3de216a5-6bef-4cd9-8617-434228e63086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.196.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b0227f-e8e4-4039-a072-5f73e3fbf486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.200.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f16abaf-7202-47e2-8534-6fc76f016ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.205.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d203bdd-1f87-481a-aa39-0a5760aac2e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d7539ef-2812-43c3-916b-2903dfd635db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fafe4f2-f409-41ff-8829-5290a570d7b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc682615-ff8a-4d79-a50e-cd33ceae08b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2adb4ba-b9e6-4866-93e3-fa33358e6b80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.207.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74b6992e-a1a5-4ef9-98b0-003df6780bbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.209.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d902b18-7596-4448-84f7-b40d1de7e61b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d76faedb-1fad-47fa-b82b-fb1818413cd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a268cebc-014d-49b0-9a30-3c06a9c73698", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.213.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32e96718-147e-4532-9032-888c6c9a15be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.58.215.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ceed244-d64e-4c4f-9741-3793cd2540a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.198.131.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d474c58-d848-404f-b41a-a8fbc6167d72", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.220.42.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4348a82-fe26-418f-907f-481e4b14d5e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.226.212.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a19818-c440-4925-8838-a2edb8697e40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.227.31.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd2363a9-9c07-4e32-955e-b2b0a5306e8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.251.110.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12e518c8-1aab-44b7-816f-e0df2e95ac25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.253.113.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e61ad3d-5ea0-4d3c-a307-4f67e7dcb970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.29.194.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1475d1bf-fc05-438b-950e-e2100da71181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.43.27.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec752390-6ee3-4775-8186-3fd61b594414", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.70.97.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b2d083-d64c-4a98-a6ef-2d1adc6d6475", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '127.0.0.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35e2675b-7b16-466b-8388-38cc7fa5b08d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.0.104.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308aca54-1010-497d-b5c8-70a6d1361144", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.34.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36d2289c-3286-4c51-8783-97119c4bbad1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.44.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1bbd65-8480-4d86-ba60-3679f3710457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.226.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b213db4-7bd3-4fcc-a6b2-241cc0d6d483", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.227.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ce89545-be47-4c39-8d37-6f74a042b49f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.229.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e187e113-a83d-4c1c-82f4-cbbd383d3c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.232.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30d71137-1ca1-405a-9e66-b0288d318a55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.233.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecb63cd5-4b47-4e1e-882c-6e92f095e7dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.237.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb0db6b6-e6ac-49cc-9b09-dba0e192a02a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.14.239.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785b0167-81d4-404f-8cd9-973c9adeea8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.228.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c5178c9-050f-422b-bd7f-30a6cb184449", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.199.8.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb149f99-c30c-421f-b026-a3776256f3f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.203.204.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--428391bf-9cc2-4a4f-8443-0138e5ae5e25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.150.47.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--221d40b4-4e2c-4417-a107-b4efd7a79ffb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.211.229.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37aabb01-7806-4e7c-9df3-2bb2a762d566", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.213.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--490c283f-0ffc-4c6d-85ce-45bfb0a94c1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.28.84.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20230f92-2f25-4dc8-850d-0de66d7ab759", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.218.97.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49dcb966-f4b1-4706-bc20-2a0186a39d02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.222.38.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bdcab51-40f2-48af-b9ec-74e21b680492", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.58.198.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3e2746-764a-4e9c-97a7-5861a4a15df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.104.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380985a4-ad76-48cf-9249-728a6437e2b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.113.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb7b9c44-4455-4017-866b-99f1f9919814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.86.117.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84bbc54d-4789-43d0-acad-67fdbc9c17d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.121.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a88e238-e9d9-45fd-8b76-cc69d083f701", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.124.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dc8e00e-5362-43af-b0e6-550a7772d76c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d07b728-0c0e-4c73-9975-853ee11b293d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4366ed00-e6b0-4ba3-9350-1386f9ea8f35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e686b674-fa2c-41f8-b04b-14536571ee99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.89.125.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4e1665-921c-41a3-9fb6-3a9a67f0513d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08658c02-7185-4fd0-b20c-63ca69e7a790", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.12.180.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22b09baa-ddb0-48d1-a207-f078bb594d2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbae92a-9f05-4504-97ee-9b08c3932b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--792cc680-061b-4faa-87c5-ad74c1ebe2ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.131.162.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cae7f6e-f6c1-4a9c-8321-ed6ed7f1359e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.162.228.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f9247f-3e34-42f1-a2d6-4ff5a8c08df6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '132.248.44.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdb2e9b7-a354-432e-a4b5-83a7cb37015e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '133.18.122.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca61a6a5-9767-47c7-b490-143a54875568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.106.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d3db4c-1101-4e5d-a1e3-60fe55f2240e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.19.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4027468a-0eda-44e1-a373-3f364427ca96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.39.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa622a8-dde8-416c-baf4-cacfdd123ff7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.91.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8893e781-d0a3-40c5-851e-e6343c46236e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.122.93.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c847620-ef1c-4f1c-9252-4754496c6ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.150.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc2bd741-3971-46ef-a550-d2dace65268b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.72.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b57398-bc0f-4907-8675-2cc849cb5c15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.82.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--651b59e6-aadc-4ff4-9378-ef11ad93fd3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.33.73.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1245ffba-fa47-48d0-bb24-d656ce268c24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.112.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7d30c92-5940-4cce-857d-2d273d779600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.89.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bec1f822-896b-43f7-961b-7f83b73c511f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c29340-a116-4bd2-92a3-85a8bf20b60e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.96.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adfbc9ed-01be-419d-accf-a0aa8ac81ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.119.97.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--add0847c-495c-4ced-904f-b1ee9c01037b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.222.40.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152c5abb-e52b-4323-a319-b96ed8f48159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.112.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef0017ae-4002-4dfc-95c4-6e9a879d4406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.233.97.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf6caed7-81cd-4e65-b78e-98722ac75538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.120.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93a365dc-d339-4be3-87c8-8bfde7a36dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.122.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--081fb8c5-d14a-419c-aa02-2f027dcc56a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--858f8e8e-a80b-4661-8004-de33e975f46e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8a66d17-9329-476b-8b81-4c7e1b46e21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6938c1e7-e945-420c-a7bc-f47e214f42dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.124.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e514413e-2a30-43e9-8d91-2fa41ac9d403", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce5b7f8-21d7-4bf3-8d66-c4a1130cb508", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616faa88-af46-4e37-a724-c621b77477e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b64e367-ed6c-492a-ae12-b64f2c9d2079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e31948-7956-45ad-bf8e-7c324cad84a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.125.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c1235f6-f821-4061-a46c-abb07ab9982b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58800114-52ff-4fa5-9eac-4c8cf213a859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0922030e-4fcb-4182-a636-ca9c95a24ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c4465cc-af72-4159-adac-c8e5dab51ef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6665b11f-d303-41d0-b374-9129dbc43e3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e29e91f-4dde-4535-83e4-9801b15ed977", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be56b8b1-76eb-4add-a323-8ec473e703bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69500040-7b63-404a-a6ff-2dc9918182ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41087110-7c20-4148-9549-d60a20a511c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eda582e-57f4-49ae-affd-7922b60f56a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.126.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27490e5d-c9bc-44cd-86ef-097bf078796a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c9d0d0-10b0-4ae8-a704-5ef5de903d7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.237.127.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658b3d73-efdb-4785-8ce1-5d59486adc93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.107.15.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f50ceb-3ed4-421a-80b4-723c32a47cb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.117.104.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b80c1ee2-79d6-4c5e-a20f-a51c3360ec7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.117.252.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa5b9fe-5c69-4879-ab75-365a0827cb2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.119.71.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9741d190-458c-417b-a182-b72716cf7b78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.234.249.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21281290-7132-43f8-9bd5-590e047cebee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.134.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166bb508-6b45-4c02-a039-ea8a642ac971", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.171.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f33a7dcf-81ee-463c-975b-9f541f11f2a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.184.36.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab516694-0071-4a0c-bcd9-fa3ae4a94317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.59.54.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e0ff2a9-3efc-479d-9ee6-425806265086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.32.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3f2914c-530f-4416-a63a-d5d800b666e8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.124.30.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--504efadc-5321-4a0a-bb42-5ac72578801d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.16.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5905d27d-eb54-4f2b-bd28-908de69e3cd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.205.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60cfa017-a5bd-4f28-adaf-b06dc1b6a65c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--504e9f28-c1bd-4bb8-9e03-c96d27d27168", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.226.239.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20f65f93-b030-4ec6-a163-9fb253c12369", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.246.253.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a817d14-89b4-4f01-9e73-29f80a7c63f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.252.100.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--207ea854-694e-4a09-a481-88021eb23cd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.65.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b08103-9ecc-4971-a8e2-2b3b1c1b90d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.235.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53397cd-bda2-4955-830c-e6486bae4dd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6e79ff0-2845-407b-ba13-612e744c1493", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f336d86-2968-4b3e-ae51-27b72597d071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.144.239.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3300d36f-ff18-4b9c-b440-169f0976163f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.117.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f608482-5b2e-496f-9bda-0766e9a89eb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.162.66.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4b5d24-2101-48bd-8722-3fa84f889b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.167.148.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d8de62-7912-4f11-8cc0-57474e201467", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.198.29.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1922e2-73b7-47d1-9be5-25a515a7fe77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.173.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb115c4-ddd4-4c28-87f5-6321f00beeec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.4.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b28bd46-afea-40c2-8bdb-745af2470b51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.42.255']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f57975-d48f-46f0-a15c-38d9fb0e8caf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.112.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--579dc960-858f-4328-a463-d7d4712e6d4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.117.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d1b20b7-d712-4bcc-8f24-68ad60f046d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94dd65b9-4c20-46fd-a432-08576ec34502", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d183248f-0350-461c-8c58-8dfde4a4e158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.127.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f371ad99-9d08-4cc2-8cf8-0392b770dfe2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.140.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--267f96bf-7920-46f1-a0a0-e6ab540aae32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.84.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152a7cda-088f-47d3-92a0-64945a07919a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.166.33.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--700dffd3-da88-44e0-978e-ada3bf1de102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.173.19.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--993bd552-5b37-4349-92c4-12d0ff6d3d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.176.44.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4a2c1b2-8e52-400f-8a1e-a760c909a50e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.182.253.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e652e50a-a750-4c27-9d64-0629386e9b15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.189.207.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cda9a93-8711-4645-bb9c-1c3939e84903", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.22.79.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75e31eea-f191-4621-8f69-cc200870b25a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.224.141.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b44c04-b234-4cc0-8e5e-a1b01cc87db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.225.5.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--304f9d52-ceb2-4c87-8a22-0aa068976557", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.241.81.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f168af9a-592c-426d-8e85-0c330485af87", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.248.82.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f237d2d-1d38-407f-954f-0b919e839f2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.249.198.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45c43e16-d457-4766-97c0-1e219f5be15a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.52.46.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2bf06c1-a9ad-4c29-bd76-9e9170bf3c55", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.55.31.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb22a400-7a4d-48ed-b8e7-ad9e21292e96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.233.190.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6812a4ed-f1bd-4838-a72c-d0ad2f5f16fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.94.94.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6275e6e-3180-4bd5-80e4-c02dfd82baea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.95.34.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8e87780-37b2-40d5-ad47-ec5279cff1ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.11.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6c55d7a-6173-430e-b124-7ac422b97d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.83.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7abf6f11-fb0f-4f34-9cc8-9dcc8f47427e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '141.98.9.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9311458c-b62c-4597-90f5-f2e09aa75882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.105.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf74c52-1ea3-48d0-ab04-c9803bd5be5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.175.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9001c9-3ee1-4e20-93d3-5865a639bb38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.253.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bae680a-f97d-4063-a677-df930034a73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.60.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3850b991-f10e-4388-95c3-55e04f626b42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.105.29.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7534a61-dd41-496f-bce0-102a7195144c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.170.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36184c29-0dba-4682-9963-4c83e30e876a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.110.182.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ee74b8a-093b-4f78-9ba5-2899cfd499e5", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.117.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9240a4d-bc85-4198-b988-e758799fe49c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.123.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ba858f4-9131-48ad-b878-69187e680831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.37.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4cc8235-5b11-421f-9c5c-dc1ae37bdafc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.83.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4151a67e-e224-4078-a668-4e28e248e1b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--301c90aa-e322-4549-a7ee-d09ed38f0a6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.0.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af62efeb-05d8-4d8b-b416-048fb966ad84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c3787c-9300-44ed-868c-ed8c0054e87a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c914881-a255-44a0-ab11-9ec44104f21f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0be609a-4b85-46fb-a248-3ab998465d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24863497-bddd-4180-bcf5-723fedfffdd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde6242d-363a-4246-bf8d-89f0b751cd60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f84ab653-50c6-4373-bd60-f0cd073f01fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--658860c7-d523-4a5b-94a7-f0c27e8a0a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529e08bb-ce72-474e-82ea-ed30d9930c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99ff1d1f-feb9-47df-ac8e-7e28c718024d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf7924d-a319-4820-a024-9e9c7d9a4e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85f5a7bd-85e5-41ef-8fef-d846fcf11b67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.1.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c7c2d0-49b0-44cf-8fac-3c6faaeb0d04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e1246d-ec12-435f-ba2a-5f1f62af84a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be5994e4-7da5-4aae-9f14-f0b16a80ab36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--813f9ceb-a55b-447e-8200-976d79c07128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c107598-dd62-489f-9b17-2d18c45682ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.164.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6607e5fb-11e6-4fe3-ba74-022be42f182a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac9ec518-14d8-4b42-abe8-1b0293761ec0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.42.173.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d0d833f-905e-4736-8305-9d056a3ce105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.202.82.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dca75c62-abf4-4d27-9b1f-91405d7e5186", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.217.74.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11b598bd-e243-4af3-9f7f-8712a7aa6058", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.48.135.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b3e7a5-5707-4ad0-88c7-999ae34af7b8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.52.211.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9a80f30-188c-4b49-858f-2189fa5477c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.6.131.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1489db71-69c9-4480-a1a6-38cbb76d5ddf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '145.220.91.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11a1abeb-3b98-4293-9a59-bf407698e73a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.148.121.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e211981f-a0ea-4241-94f0-80ba12f50f7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.190.119.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97b1ceb4-49aa-4383-9ac2-457a8f37f563", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.59.229.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9acb1273-44f6-427d-b58f-16805b139ada", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--408393c5-8709-4014-bd26-c89d12327c3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b2bc0ee-f553-419b-83d3-4410834ac4d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.240.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--308e501e-0784-43b4-b767-3e6130984390", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.139.136.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--355321f6-4f79-4160-a2ef-d96b9dd15e62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.154.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05daa6d4-7621-4e1c-aa2b-b43eb52054bf", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.188.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89248e19-fe38-493c-bcd6-ce6e6378e544", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.217.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e92aa6-d407-4219-b12a-44ee72877245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3b81162-1ebb-4f30-b2f5-9b3f89254394", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50eb67c1-024a-4887-9025-8d86c1f806f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f14d01-2c7f-4ef3-9d0d-2cb6ef41abad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21faa8a2-dcbf-4244-8059-240533304081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02144ca4-1f7e-47ea-9fa1-3e414a07d0c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c46588-0db2-4917-b909-9538419daeb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48344918-be7e-496f-8772-8495d5f005b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a9925b0-bf09-44e9-89e4-def8871b3e05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e01393f-a010-4a0e-8c92-9b8c35436591", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcd3f46b-ff20-43b0-9a34-a58c79f3e228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54198de5-1a8f-4b10-b62a-ec7703fadbb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c7f87e-7d33-4c2f-a3f4-a5b2b9a76408", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf5c70e-d252-48d7-a5b5-693b9f678465", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8144938e-1cb9-4151-a52b-261d4445a1ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df95a25d-cb72-4260-b490-9a690fe063b9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37f1c7b1-05ad-48e6-9ad7-962e5bd99f06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b8568a5-89fb-4a3e-89ba-42567f57afbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad43777-af85-40c6-91e3-a9c6c4906574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0d5dfa2-6d4d-4c48-b01a-c50f76c6ad34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f154f3b9-ca1c-4c04-806b-e257728e7467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19b75f8-8884-4b43-8a03-7732b4863181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e480fee-9dff-437d-b391-21e8215d6e7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3e7cea-f4f6-4620-9e6a-a981622c0097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6791861b-c246-4ac4-a4d0-8bb249ad63a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb511ac-a705-42fe-8cea-5a8bcc80ddaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e759c74-ca6c-433b-be4b-78f11740da90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4904ca53-64bf-4128-9b67-232b8145c3c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d340449d-2dcd-4207-bd45-7ff6030e8fae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01554135-0c50-4356-90d9-829edb27972b", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d15c67-9601-4c39-8f0e-1b7fb8e024d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d20e8fab-8fe4-4c80-8f78-61b838068f62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--036622ac-a7d1-4b12-a423-60c8cc284264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a94e29f3-3373-497a-a177-c3305e34e274", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8e6d01-e75d-441a-baa2-34e60331f7cb", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12b3cb8-3a3c-4327-92fd-051d3b872ccf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59756c6-f5a9-4ef5-ba47-561c1621917d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da764e70-f03d-40f7-a36c-8b025bdfd9d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189ea21c-7529-4a79-8185-1d44167d055f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c0d7c59-20d9-49f7-8e91-a837f94d47a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d914b292-1f2a-4e5b-aa13-6134bbc01cd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ac94a4d-d719-432d-8ab5-ae3b85673ca2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032f9ff3-4a02-42d4-b434-7d4ada542c4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6930a087-e66a-4ab4-bbfe-364ef9e31920", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4392bca8-7e69-42bb-b473-5d2564e162ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd8d8f14-23fe-427d-8ce0-36cf89aeaf88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6e8441a-773c-45a9-a0ee-b346c2e5501c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87589342-19b0-4f5a-b3ed-684f0ffacc8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0f114d-a774-424f-bb79-49cc5467fade", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337bd29a-c79a-4633-86c5-353e670afc05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e6381b9-d8b1-492d-84ec-677b23759208", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fcd095e-163f-4617-a525-b9f15c51beb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbb235dc-3382-4018-b32c-d337aaa9a190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e0e2a76-337c-457d-aa58-56483edea3dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f26c4cf8-5c5b-4316-a3de-0fe9c8a1a2a0", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89e0f43f-c380-4a4a-8572-89e75f6a86f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46ee7f57-6ca9-4bb4-b4e6-c85f9702c6b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--322a3e63-4e23-43dc-ab48-91e6e26fbe44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5231cf30-df9d-4dae-bec3-c066bda6e34b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96b8d66c-a8ac-40db-98d8-ce9b6b0a10e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64dcba2-b10f-4ad3-a39b-3b55efc4cc8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14cb8ec3-aa8d-402b-8f18-1ae7900d1683", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f10b255-2f98-401b-a725-de1813da5373", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e8096b-9af1-4731-aaa8-bc4cc5fccad9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1681f959-40b8-432c-9475-3c6d2aee1019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b199db-7e6f-4ac0-b74f-98c081972b3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e0f0484-7889-49dc-8a03-6026ce866829", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0bdf4f7-ce31-494e-9db9-0138d62df499", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44394380-af7a-4fee-8449-26a6a5ae8bd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de321eb-24a7-4da8-8c55-3ced4ecc3d46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a89cd6ec-363a-4a7b-a373-5adadcae04a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a7620a1-22a6-4bd8-8062-90539b119ae6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2714117-fef8-4014-9409-d33879c90d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c3b5b6-d293-4d4b-9e20-ad9475135dfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d6fc059-bac0-430d-a170-9dc43b259d03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c598acb3-f891-45c1-8dde-456e87626e76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--920ab9b5-6aea-4921-a67e-d5fb835a8c71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598dba47-1dee-427f-88a5-5ada096a4eb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9e4c23a-1390-48af-8ebd-f8b46ca623b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dbfe632-5fbc-458e-a753-e9010ffcbb00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce26e4ef-9adb-4147-b290-143a9c6c1495", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b4a25c-af70-4ae8-b5b3-b393afc74315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21d43c65-bc93-4e9a-9ac9-a38147908ebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e2b9c3-edf8-4235-bb58-572cc8e8a29f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88264ef5-0c86-4f90-a07f-e6b136d62cc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d52c280-7b71-419d-8933-825c3b8a55ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8441a62d-998d-4e7e-888e-739d00ad2f4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6beea41-9b0e-42d7-8525-eb2871888227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f99fdff-5067-4c17-be65-1d1cb81a9459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--597c3ea0-b372-4d55-9a47-5fa366a349df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aec4d06-1886-4be5-bbe5-fda74030e2b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d22a897-4ca4-468d-9bc5-8215fd2b68b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--399af4ab-3fb1-4692-b496-d938f87d173e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a473118-1c9a-4ba8-9a4d-7a25ce8f9618", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cd1d45f-c8f9-4ada-9586-6b978ff402bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cbbdd1e-a1b7-42ed-8f64-dabbcf9211bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da2bdf7a-724a-4294-b791-a801cfe4f518", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d1d1e7-32fd-4a5d-8ad9-9f516b681918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a8cf29-d00b-4077-9853-dda1fa7c1b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beebff90-9224-40e0-b73e-92ad58e7065b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2d220e6-3a58-4f17-8ce5-1bb504a7ef03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69b7ff47-1648-4e28-a086-6839cbe93515", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1f7a277-d8da-4fa5-a431-517d9f9e8a5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8117b37d-48ed-47c9-807d-212a0eae7796", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b022fd8-439f-4749-b1d7-b5144e4f4810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b934fc-b179-4472-a040-9f6ebb7678cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df9d1f8e-f704-4b06-983a-d648d195957c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c8b2d33-3b44-4e15-ae0a-e207016706dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a0e978a-d517-4783-8c5f-61de6f4dd09b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--566e529c-641f-4b9b-9126-685c28dd5a05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82fd9cd1-e037-4281-a443-a335417b7a87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff71561d-a490-4760-9739-262a61b02091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f039ba62-438e-4849-9a90-52dde053547b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08f7bf64-b291-4c13-a2dc-4c6f93aa1f07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eefae3f8-47c7-4e49-af99-0d5001712ce1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--415fb1c6-118e-4af2-941d-cc51e7aec2b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--014321e6-5eb6-4b30-a2b8-1f40117c4b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fb0b4ae-ea46-4b1e-887a-e3ef0007209a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cf47d8-551b-46d7-926e-561b8e38d28c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f88fc05-af2a-4664-ad56-c9818aa2b9b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a4b7f56-fa59-4622-a46b-e05c9a025407", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e08adcf7-efd9-4750-bb99-415a5eb15311", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8a7f44f-3b51-498f-b13b-83feaae8067a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104114af-5a4a-433c-87b6-f3e92555c888", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.133.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18717ddc-96cf-40da-894c-b525ca30f75c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.221.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fac5f52b-f129-4201-9254-b92a83d1a1bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.113.221.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620391c0-28e5-4833-ab73-0f4bbe07c1ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eccc1a6d-5262-46d0-bc74-6f58821a5404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.121.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4fb3ef-7842-4012-a7ce-6ecc05a8569d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34e552fd-2994-4474-bb27-83d480f8db39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.188.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b52c414c-ad2c-4b15-9ad0-a784cd2756af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.245.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d5e21a7-a132-4920-89de-760745ecb71a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.153.56.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b9a72bd-b69c-4cd5-ae1f-d62d5bcdfc18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.222.223.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b613b28f-4dff-4c42-b310-2d30b5bd5dc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.244.84.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd97862c-58ae-4bd7-b40f-e3e3728bee5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.253.35.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0026ca3e-2bb5-49a0-bb9a-689079dcdcc1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '148.66.132.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d88e2c6-d17e-4804-98b8-428fe2c41294", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.56.85.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e6c4eb2-f96b-48bc-9b9e-bdd7fe6e6792", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.133.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0446e60d-3843-4f6f-a186-a1ea232083f3", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '15.204.156.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85b23c9-fa55-4a6e-a32e-afdfe2886be3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f9febee-472d-4cac-a7ee-720619e7bc4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea8f7fe-53dd-42fc-93f9-618af9abc75d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c8930d9-b4c6-4c86-9e8e-09bc09a77018", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed226c78-66b9-4231-9329-1f003d8d56d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54fa6ba6-e829-4f32-bc94-6088d1a9776b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aab0237-a946-4186-b2d8-9874a6244b4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b6b4e2-c5e3-4162-a98f-1d22ab13c716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6becaf7c-f8d4-4680-8060-04baa55b4389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.36.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44801442-d7bb-4512-a4c1-41a3f3d69ab8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8babadf-546e-45a6-b561-74d8c7dc60b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7af63e22-5b65-4e1d-a068-499a66ffa405", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f88f7d-354f-4500-95a6-62df6df06560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc212020-f5d2-4c42-84ff-c902c7de54c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b8b693-e460-4476-bc25-f8ca702ee700", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd672f16-6ef2-4ccd-acf4-af82823f309b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50ad6f6-d335-482e-a37b-0da55dad2603", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f759713e-802b-4026-a416-15070db19abf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b2cb838-8655-4ea2-adfa-2a8753dd90dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a360280b-321c-414c-bd54-c18bf2117072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17153878-b425-4f1a-87dc-46ab84162029", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da909be6-db24-4325-9f0a-11c21dd3d88e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb3ff49-724a-4f02-b484-00200af400a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc050132-ae30-4800-978e-d751bdc2ad51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3209a48-91bf-4b2f-8c74-9a60ce95eb93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec8d7ae-73fb-4196-9842-a58473bc8b25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67f1db7-c8f0-44e4-979e-037eb5ec9cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228eb816-5679-45ed-b5a7-bfd388e79fc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6041836-2a6e-4964-9705-710805d3f85b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa44a188-5d67-4e92-92b4-758fc202c417", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5103bfb-3054-489c-8802-58f164b5e0ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe2f436-f778-4675-843b-8df7204fac67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f869d6d-5942-4d1b-b536-4640793c3e72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.107.38.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8d505e0-7452-4c0e-8daf-0cd41192e2cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.116.126.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a143e826-6d25-4412-a23b-f156576127ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.255.253.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c017a379-2448-435c-bfde-9aa34f80acaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.185.42.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8c1788-b74b-4def-a807-fd9625476e09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.237.79.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f434748-c100-409f-a70e-21a73e61507f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.240.65.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--526d0dde-4396-4fc6-b146-8d16c9086295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.242.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceed4979-934b-45fc-ba9e-ab765ee85157", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.30.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73241776-665e-47c2-82e1-7f650efb517e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.136.188.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1fe0016-b41c-4259-94aa-44803fe16dce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.172.100.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e71ea6d-140f-4bce-9c32-f33054263df9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.244.200.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64fe8f3b-9d69-4d4a-9791-efa55e07e3e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ba66eba-c42c-4cc3-b557-f690121bb6e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7d0ab88-83cf-45b9-b3fe-f9da3b353261", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.128.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cefb332-6edc-458a-965c-cbb10612d376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.129.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daad3b67-832a-4831-aeec-8ac34956627b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cfd2909-0f1a-4808-8e39-cfb9a1f0217d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.132.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4ece8e4-c882-45ba-807a-cb64bf8884ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.134.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc3d64a-5585-4f6e-bf17-e07cbd9fd94e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ae8752-9606-49d6-9d01-ce12c46c87ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.135.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f75ff5ae-a19c-4009-a5c1-9c6fc91fe033", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--125c68de-e363-4760-800f-4d3a5d1cbb94", "name": "Malicious Host", "description": "Observed: FTP, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.139.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:ftp", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fa973ae-7e79-407d-b0af-29bc4652b944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dfb798b-1297-4663-8d86-ecc53f361adb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.140.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d5bbc4-b721-4f5f-b8ac-4b4fcc59f1f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--305e1519-8de2-4cfd-9a10-8f9d08433c07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec02cbfb-fa5b-4df8-9b3e-b98e34e85600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32626f32-6d16-4423-9857-61945484db7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62e70b23-8dea-4fc7-937e-9d2fe94faa54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.141.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c172f7-7cda-45a0-b6fa-1e787407456d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9031a266-bb44-4b9c-a738-74232efbe605", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.142.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23cea518-480b-4794-936b-ad5267e834ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.143.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c81a77bd-9fd6-4622-8a4d-ca39b9be25ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.143.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e19330-76c5-4182-a322-edde73ba7da1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.146.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740977db-ed33-45a8-8dd9-5b5ef6c2eca5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.147.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a81df84-427a-40c6-b5b3-03ff0d339d7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0317e4e1-6891-4481-934b-233a8faf4e0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.148.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d95b7767-e67c-477e-9efd-b3c08b2be8c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--642795d8-5b83-4b6f-a21d-5a11aef5604e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f90bae0-b489-4d49-9522-4cd5501b9e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.149.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db09ca7-d93e-4787-ae2b-4b4f0782771a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.150.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7edb358f-137e-4fc4-ad27-c066e1f4da7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.151.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf13fe5-5edf-4d4e-8f19-1e89fdfed3fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.153.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ac48e07-575d-4c23-9e7b-36236881f456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.153.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99982b21-6e95-4f8d-b24b-e75f3dd9ab06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc537510-59e2-403a-adef-44f5f2f9b9f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc167214-d5d7-46ed-80f4-bf058b356acd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb67877-2f07-4db5-8513-fbe3590d0dab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed89c1b-e572-49bb-867c-bc7703e81187", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.156.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--355d8b20-9816-4f77-b248-85d675b9aadc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3800ac4f-7add-4795-a7d2-2c0cd4327c0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.157.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de348575-ca8e-4d0a-921b-9361318f14bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236f53f4-f40d-4553-8efb-35a73cf9571d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.158.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ee9ca2-288f-4aa5-b198-29ee2ada1982", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.162.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f42b075-8bec-4ca4-ae94-52a3855eedab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.164.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70771d01-941b-454c-a0de-f3adb05178f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.168.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01409f07-5484-4da3-94d8-c3039a20f51b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17929d1-2728-42d9-a31e-439b57a4bd53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.169.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12cb761-037d-4a53-9c95-c0f93d5ea883", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.170.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44fdf3df-d8f4-4cca-acef-1978ab40875c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.171.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09930705-f539-451a-969b-30ba2f47d243", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.174.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31af87ef-bdc6-44c9-8b3d-f5ba2e648b5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.174.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4370de50-d80c-4641-a882-697854510427", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3dfb95b-1ad4-42d1-874c-4cc1ffc4a2d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6231521-f3cc-4f78-9caf-73ae665cf3f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.180.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5575e46c-88d5-4f7d-945f-308f46c129d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.181.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5517973a-1ddf-4d8f-9c73-889190e195a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.181.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17423507-2be6-40a0-a3ea-60c2b53b8b56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.182.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c94201-a87f-40bd-bf41-762c8026b110", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b595d11-8c39-431d-be0f-8c73f00d0a18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4400dd-863b-4db4-bda8-6ec6abc43444", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b56eae-0478-430c-b2cd-157075d31dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce58040-7ff7-4791-ba12-af3e3f1bfa1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.183.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ef471e-3c6a-43a3-b3b2-4d492e8983a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.188.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c815d2fe-105e-4fd1-a749-888ad417dc38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.191.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--033d43d3-939c-40b5-a916-843e2aeebbe7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf547142-5c18-444f-9342-efade91a452f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.197.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6b61cff-8155-4b07-a269-424b804abc56", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.198.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ef3466-1fc7-4437-9ca5-bcaac3859ce4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.199.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72026e33-e953-4a6f-b931-29fe6412680f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bda0acd0-2bcf-4a6f-a4c1-4791bd4dab79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.200.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--501f715b-c541-4dcf-9fe6-ea1a9ca081fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b71a32c0-decc-4e35-b231-448287f491f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb6ba52d-9646-4579-9287-c4410f90e229", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.201.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e59a0f17-ea8d-45d1-9e89-8872c27a38a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8071c1d2-4d88-4b68-a865-2c2958382b05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19676a98-394d-411a-9ef7-ebca74064f88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.202.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34d742b-64b3-42d0-af73-6b9dd83c1a2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.203.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1399bc76-373f-45fe-91f4-625b91bf8c75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18dbdc62-75ee-4e7f-b20a-3953f3edba6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88c53fff-dbf4-4274-a34f-d55bd46315e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03d38fd3-6251-4f8e-b782-962538047d67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.205.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8facf219-c96f-46da-bc49-d284abf696aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa3bd905-9d16-461a-8d01-5ad003f8ecf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92fd9932-7ea4-44e7-97e0-01ed7edd6934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.206.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dfb0da9-fdda-42e1-8ee4-1acb2481e865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dad94d16-17c7-45ed-ba97-907480f7a5ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0ce22b8-34b5-4f42-9d63-4915c0d666ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--969e0821-1e07-40bf-9381-ae220d496d1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--474901e0-6c72-4785-b0c8-c55cc8427941", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.207.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--730e82cf-c216-490d-8603-7ab7db056bac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36a673c4-683f-4f27-8703-862a3d2723f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b65992-47df-479f-bbe5-3cebc543edbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.208.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--092c87d7-1c31-4a09-8872-e9d3d16c00e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.211.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6582e8db-ba11-4018-9547-8c6098071388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e02cf31c-523a-4721-ac4a-7b4288d953dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.212.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c1be848-5383-48ae-94c0-a2436bc10fdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cff16dee-8311-4f4a-8672-4f28284fcd81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.215.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8535860a-cec5-45af-81e5-fbe721b36a03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.216.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57bc7a3c-be19-4c4f-85dc-ab1b095b06a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.217.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4411ea39-31d7-441b-9258-70d3e23563fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.218.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47bde26f-46d2-44ad-bb63-53906592812c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e93cfecc-7179-460c-be8a-f56eedfc2946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.225.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7940a199-b2a1-4ebd-a89d-a139bf919c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.226.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b366e1-b771-49d9-b57c-9a7e16ac8d07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.227.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac7c4baa-f7a0-46fe-afda-32d2e31d900e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.228.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afe79835-c4c2-499c-8eee-a16f540a0410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bc4b3af-f031-4eba-9d72-bfb7b363d34d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--263b49ab-46b2-4b49-9b54-daff523704f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1937631-225d-4e03-beac-0dc47f584f1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c32da738-3106-445a-8728-6c51485325cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.233.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--638031a2-ceb3-417a-9bd2-bd626c132164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4136646b-db6a-4bbc-a413-12f7b4574b9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--837edd15-83e1-4485-910a-b9046ba00a1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c99a59c-7b4a-4464-a266-3abce48cb6e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.234.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be3216dd-8957-4077-93f6-2b65d556fe68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56b8e30-0598-4e11-829b-7763df747f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5f9b848-c11d-430a-b2a2-7f3a0a961098", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78fcc6de-f4df-4715-9116-b63e628070dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b04adb-002f-4289-a354-d7febab7a04a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc291da0-474b-4d2d-aa0e-1f69261d488a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.235.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e29bbc7f-669e-4233-a447-60bf7e2992ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--456ef3c8-2f86-40d7-bdf3-ceb052c2a93b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.236.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52107653-fa53-4085-a46a-f729e357cc51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.239.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a9f347c-60af-4d5f-855c-c7f95b23a66a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.243.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a404c4-5577-4152-8e10-e6ced81c0e69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8eab87d-25bc-43e8-af25-8208082c7d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.245.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a6f0d3e-484b-4276-a4d6-3c51ac254802", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--326978d0-dcd2-43ac-aa0c-37a55d225821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad09d1d1-ae8d-43a7-b260-45f868ffbe97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.247.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dff98657-2f0c-4ae3-aa55-4067a1bfbf15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.250.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1f4df21-8691-4e95-b184-01443d83ef71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.251.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045fdbb7-1cb6-45fe-8c91-645618fbea57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85282088-e0c7-445b-a28e-04ac79371e67", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2c1e877-31c5-4b60-9c3a-a4d5048b055a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.252.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d22ff2be-59dd-468b-b451-efc06defb8e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.42.136.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98933ba6-cc26-49eb-a940-43657ad4fb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.191.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--477d577f-213c-4cb3-bd93-8808e3b3ccc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.22.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8871424-9a67-4472-9cd6-384f53202a92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.53.3.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8941a483-cf56-4a0d-ac89-44c61c24883f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.1.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f154da8-e1a2-4f29-bbda-39d165fdb250", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.1.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3799fef2-b0a1-43a0-85ec-b8a74c32edb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.0.30.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ec34a3-3a5b-4271-9a94-8448f4052cbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.16.180.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed58ed9c-c78c-4a47-86cd-fa3271168801", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.18.197.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2306c2bf-4b13-467e-81d8-ec8a3a262d0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.56.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f47a28-ad8c-4628-9950-b21e6bd6f400", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e03f3f1e-94bd-4112-83d0-99c80f5db7ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2079ef0-fd22-476f-9e03-676ffd33c2c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f91b278-2319-47c3-a8fd-489ef886ad12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.197.57.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5656ce49-e94b-42f8-8f85-c3770771f3e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.221.17.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ec2913-faca-4cb9-9c41-8bcc63aacd39", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.221.23.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b5dbb5-756d-4443-b04f-d47b75254113", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.41.180.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--777449d1-7653-43d2-96d7-5ec408c1c3a9", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.61.72.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d48ebb6-277e-4241-a9d8-c4ac49cce367", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9998e72-fb84-4a9d-a05c-b484ecabf78e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adfa46d9-a257-4157-969a-6cccf03890cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b9fc64-43e7-4569-a963-88b5784f259b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--007c2e0f-34f9-450e-b830-0a0ad4b23c2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4821db6-5d48-4efd-8b96-02b699654928", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--287db9dc-38c4-42e6-b990-79ee8e692019", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002e8f0f-021e-4937-aef9-e112fc0ab10a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eaa7c65-24ac-4958-b714-e78aa70943cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6d30bb-ec1c-4f22-a208-2ae64bb2ae58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c89066-32e9-45a1-873b-594877c32ce8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb41a2f1-b35a-441f-94c2-4b8d8e61bf2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b84b43c-e585-4522-bde7-bd377f354c9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df1b57a9-924e-44e9-b183-66b9f19b933c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--478f3b26-4009-44cc-9324-7a8026ccbc31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0da48a86-8424-482a-961a-172d5c6588fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e98e187e-9fd0-4845-8806-2ced5647e82c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22127bfe-e3f6-41e2-a5ca-ede13d461b3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1100413-f6ec-4853-ad79-180ecb47cc60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ad8de4-8f9e-40ce-9f56-37cf0c1c669c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617628ad-2217-4f3b-a3a2-dd21db54f360", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.197.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1171b64a-b9dc-449e-940e-3bc774aafc67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '155.138.135.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aeefce0-5248-457c-8981-10fb0938d5c5", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.227.232.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17298410-5e8a-4c52-a7ae-ba900fcd537d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.232.13.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cc9a68c-d8bc-4cc1-a7a1-38b30feb4447", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.245.205.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--468da4e7-e164-4799-a9bb-bfea3e398198", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.245.239.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdfc198d-ce4e-4f6f-a0bc-933d73322d58", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.38.73.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ec60e3-4c84-46d4-af7e-3d05c9acaed3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.15.67.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a21731d1-0ca4-48fd-96e2-b0dd6c2f749b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.15.73.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d9f4ca-b675-44a8-9b2b-6590f0649dca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.8.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4534be-f378-46c1-adce-ae10518932c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.90.131.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44df76bd-27d8-4196-b46b-c9ffed97062a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.130.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e4e913e-d525-4906-9c24-adb8f0c304e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.203.77.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52249d9d-09d6-4491-8b2e-bb80a8905e9f", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.185.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18be7704-a82c-4b07-8c21-1bd47bc435fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.20.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a6e4c4-6b2c-4e44-b158-663773307c1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.253.120.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61c4421e-1311-4c42-94d3-b32425d3e058", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.108.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a11785b6-3efd-49bc-88e5-cacf3b07f3fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.222.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c141ba86-f820-49c9-8636-3c4c914d0da6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.249.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7287167-11ec-44dd-b229-722f917de255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.144.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb69ebaa-fbdd-462b-b4a5-3a71e0c2c3b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.17.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1d48673-8380-491d-8392-3c88dde2166d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.227.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5278e7ec-04e3-4a19-9f4c-3138707acb53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.47.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0048a846-b742-403e-b219-1fd364b021e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.176.125.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d2011c-b788-423f-a549-69596dc7d625", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.69.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e0f6ee3-c19e-445d-8e22-5f38aedc1472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.71.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06552465-c16e-43fd-b4d8-88b0ebfb465b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bc3df3b-2414-42d1-a3b4-1de2a218d850", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.119.76.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69aaa9f9-81d5-4935-a37c-42f9ea5a9783", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.30.54.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35ad87ed-b875-48fd-9481-679e4d096b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.10.76.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad9898b-ea09-42aa-9e39-5533082dedc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.10.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e411511-974b-44bc-94d1-aecdca8c551b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.148.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93d4c8d3-108f-474a-a235-903e75d852b4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.204.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c46e6a79-6e35-46a3-bb30-3094c099aa59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.235.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a0b695-4a42-4e23-92f0-0448050863eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.56.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38d4590-a712-494c-88e0-5fe6948a5810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.76.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6544054-5c4a-407f-9e5c-b90cf54b2359", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.97.157.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f756ab65-6009-44b0-90bf-1f7cf04efbda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.97.157.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41c45d61-087b-410c-9dff-ac804522096f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa96f6fa-7c72-4ae1-846d-971a82c91c43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4d971e9-3945-4651-b56f-e217f57158f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55fc8dd8-95f7-4aa7-87ee-d1a44b8c8574", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18025092-9953-40f3-8dd7-0be1d5ad55ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2d0e516-ce58-443d-9947-e2a0fddc171b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db0b018e-a2f7-45cf-b263-094fedf6852d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a3c7d21-dfc9-488b-b4de-956a01997902", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--444545b9-1bce-443f-bd56-d39bf05ba6e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ef9905c-a710-4924-95e7-8e13f654b611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1527b31b-7ab4-4c5a-a23f-458c5ba30626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc331fcc-71f4-4eb8-bd08-79e16fb8b227", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a0b1bb7-d7ca-4d90-9ac6-42d742898f87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f9d48a8-d084-4632-ae55-b6db1e366496", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc22ca97-022e-4e45-8391-2cbbdbd25450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf92949-a6c1-451c-9353-ece68b07c2b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532a93c6-987f-498d-bc6c-190ec34e202e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d09be411-16c5-44da-aa7d-eefd9aa34c0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f4483bf-5021-431d-ac94-78ce7b4e77dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61fac150-6770-44ba-8e7c-c966f9d57a92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a81dc00-2753-4a0f-8b59-15d74c8c2205", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcac53a-010b-4fb7-bd81-b0db380154fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdb10af2-bf72-4fbf-bd31-0841e47275b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a539b212-0c88-4df0-abf6-faab97fdf9f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b7eb113-fc6c-400e-820a-cecb7f194357", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b9c499-7d9e-4a10-a0c1-7fec853c6d8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3530c3-68d7-42f3-b324-d5e4a0599d43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0e4876-4e61-499d-a6a4-6a1401dc5900", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6002f81-86fc-48d0-9e03-24b976c23e3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f42f560d-eb36-4376-a22e-e1f9df3aab53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38beb37d-502e-4875-9eaa-f7c4b5152f66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19201c2d-6b18-402e-91fa-f6162ad98d4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b56e25d-2087-4e40-b279-8a2dc5f10f22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c934ddad-b0e9-438e-bbe8-3ff1762792cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ebe54cf-dca4-4e0c-b16d-5c97e2e9c020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f24012f0-370b-4987-9479-f8510a8f64fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8481d018-34be-460f-a4e0-6c77730ea577", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25dd5bd1-2b59-4de0-ad7b-faaad1781068", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--715fd75d-fdf1-4a21-ad9c-2eb2ca97ca2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--084d12df-fd2d-4f76-a455-d2f69fefbeff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d668376-b88b-4118-8ec9-fc8261f955fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd681b9-cad5-4866-973c-606e7d9f9e6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c06195d-7b04-4e19-90bf-126d3dddb8d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0e10ffe-4972-43f1-b3db-838d0e015c38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc3a9fd7-b57b-4a84-a7fd-df44e6b017a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3dc09c2-5261-4194-84b2-cfdfbdfa0c16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7deeb9e-aa9f-41c0-8e56-48fd61d341bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86a37d0f-b4cf-418d-b5dd-aae0e106fd0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8abe4d06-950e-48be-b1c7-1ea12c947b04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faae5899-3618-4fba-bf3b-71d6acb5f0c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddf403b-9ef8-484d-89cb-9b6712984454", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--569dc9e0-f2f1-465b-966b-0703c081397d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.149.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64950a44-42c4-427e-80b5-f1f0226fb8e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f72317b-f534-42ec-8f2d-2d078abe0541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4720ce4e-e18e-4a2f-90fa-e4c422682c1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06e9c21e-9327-41df-9574-4b5dcf576362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e07eae5-2cae-41eb-815e-42bf5cc9da7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e503bafc-1c7b-4fcd-8583-1902f6f76b80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a8dec81-2376-4ba0-9d24-e67d7a398f2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530e4527-6669-4be8-8f37-af4fc1e29263", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db47651-c2a5-4659-a3a8-a43cff9ed104", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88bda15c-5e51-4d2c-87fb-eb6cd11ffb1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48655f68-f405-4770-8760-4cd4265026b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2212a9f3-b4eb-4cfc-8752-9a7f57da6ce4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34efe5e9-24e9-4c4b-98b5-c09ecd966a2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4591cd66-3a6d-468a-98c3-623af880c3b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dfa8f99-eafd-4b82-a64c-118f7c5ac9d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373e54e3-6197-47ea-a541-c5cdc0aa8b05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f938baa9-1201-43d2-b3cb-4088b9cdff78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ce19518-e82a-41bd-a4fb-ff8b69a419a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3205b4f8-39b0-43c9-be7b-9f9664f0d4a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e782a37-f9a6-422c-ab79-023a2cdb6205", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--870f40bc-4f4e-4e79-b599-816be93c12c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eae7155-dafa-421e-b5ee-608b5d4373bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59dfc9b-ee13-4ce0-88c5-5ca8eb40c27d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe67693a-4d0e-4898-a92f-44152052a5c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a92f5b-9e15-47b9-9fea-5b81dedb07b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7e751b0-f582-421f-93ed-623d5bc345d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c3ed6c9-2c28-416d-84ec-e09fb2dbec5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41cc01b3-ad09-4391-afdd-213cac9b26c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0038f3ed-477a-463d-b265-409710a2e151", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--045156f2-a9a0-44e5-b23b-aba43691fb29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0760e4b-ce85-428f-a4d0-734d09bae1d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d461164-6425-4b08-8c27-bea3d1157293", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee670c17-e884-4bfd-a16d-6dbb8dc2b97d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a03558f4-2d66-4045-86b8-e82918772eca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.150.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5442ea7e-72d1-47cc-b11c-16bbf6972e26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.216.18.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aed9ea8-8a75-4db8-a612-f8d2b3e80528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.114.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--276b424a-8512-482b-b1c4-cea2af844a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.167.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3fa1875-b630-4b07-9b8a-e3e0147c1fb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.243.175.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fb49a60-7bbd-4dd4-89d5-58fb8dc78b4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.182.175.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77dc7a2b-17aa-437c-aa5e-245861d0002a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.4.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfb051b2-2bfc-43d7-a379-c17f0455a690", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.160.33.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--760fd798-49b5-470c-8eed-03b8a5774b95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.163.24.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c29f4d43-99e0-4254-abec-ee11496cab1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.52.198.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e1e1f50-59c3-4a48-a8df-028f5d36f797", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.52.24.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aa0489a-5f19-4555-a9c5-bc710f1e94c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.156.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e2f0f7f-b40d-4368-9df1-60f9f283fd24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.147.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc7997e-9096-4317-979b-b42defebd48a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.159.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--711aaf46-2e39-448c-a526-b623448ac1d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.161.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0943197b-35c4-47d4-b213-a59020211838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f27ca33-fbae-41b1-83a0-0121a2a9401e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.10.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3af2e76c-eaf2-4218-b627-f28e31ac2170", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a866f0de-84d9-493f-841d-bb7c318c3deb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba98c19d-ef48-4581-87f0-71ec81abea21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80c592b2-30f3-479f-80b9-e31b3f4c1826", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a3a9ea-0dfd-4ea1-95e0-b67d69db5c14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18a438ef-21a1-49d9-966f-7b7053ed952f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ed7ff9c-5fde-4f55-9438-644523a09a8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.11.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3dd2490-c0cf-4e1f-aa44-b47b0ebb6d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.118.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05d72ebc-213f-4516-97ea-1f6cdf69c72d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd2d02a8-61e4-42af-b5c2-6594598bd050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32bc3d9-f386-4660-8739-720df3b81578", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de4b0a42-05b3-4bb1-be63-761faf547665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd887b9-35a6-41c2-9e98-333d223011e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.120.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b92912-5d45-4c51-83a1-f9002247834c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.128.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be7dccb8-a1b8-4a73-abbc-8be3e6fc6b5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ff3ccb1-42e9-46ed-b998-f2d43e3d1592", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.129.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a5f0557-00bf-4ae9-afd7-cea628d1ecd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166f7c21-cca8-454d-abaf-d11f8aa0f0a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9ed10e-09dd-44a6-b2a8-d4e3cc386839", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5df19ae1-3429-4b32-af2a-3a7d9d27e0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd3b2f4b-be3d-430c-88c4-cba2845022f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c200712-e0ac-41ef-8733-7cad277bb977", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21baf17d-cb05-4399-821c-a1a77b72ef8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.134.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--416f305c-82b6-4f98-a848-f995477d10bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd27710b-a1d5-4a86-8402-b5ae820b114d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.135.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ec81f5e-6958-4769-898d-8bafb47376a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dd1114a-8849-4026-9b5e-7817ac21c816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb7923a1-6c8b-4d1a-b20c-c11023220116", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6f659bd-8b86-415d-bdeb-f5211f57b5f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db32e611-8fad-4e4a-88c6-e87b5b781af2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06964fd4-aa95-4baa-bdb4-a1d81af82077", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b2d4a9-d285-44ed-b897-81ce9f97c6d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.138.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba9b82fe-997d-4d11-9eda-f0887b641c83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c270c17c-f9ae-45f8-b0e8-1c4ca0c39e6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.151.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e24a574-da95-4b7b-8ab2-8e1034639241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5e6eccb-15cd-4c83-8558-dfeacf97ea83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58cdec4b-edf7-4fe9-b7ec-16283a7b18b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2447a8bd-4bef-42dc-a59c-42a508b49153", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc7080c-995f-4170-831e-03e76d3d60fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fd09a0d-a6c8-4057-a6ad-f907184f6009", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f09011-f113-47e8-85d3-8f52365d1849", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c63f8f-7019-4c59-a6cd-f5e7dd64ffd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d769c27e-394a-47a9-9d1d-7b0dcdab1c5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c94a39cc-6eb3-4553-b5c7-9da8f1fd4616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99b3f57f-9307-4c2a-9bab-4cf8c61eb03f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14eb3147-669c-4d21-ae3d-0a042d7f48e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.162.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be439283-6817-4f3b-996e-03f14364730f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663aee28-31a6-40f1-9d8f-37ad0d531e78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20e4d212-ed28-4fec-aa40-3b59ce043dfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82eaf7b0-c930-47c2-9748-74c02756dbe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71063604-f2dd-45b9-a941-feb269171699", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7d8a199-572b-406f-be1b-dcff3df143a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8df2433-3624-406c-b82f-dba12f382feb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ac8caab-dc9f-49a8-94c3-edaf245cddb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09b54287-d092-491c-96a4-f9ebe2f35718", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32c01d81-5ca0-4b0d-965d-1cf3ca65d553", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db423e8-6781-4093-8400-b60916ec702e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b3f0662-2182-4786-8f4d-0b335d39120a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.163.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--282e4154-3ff9-4dda-8f91-ee68c4753ffa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--741894ae-339d-483f-99b6-1409ed0d63f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21830925-a100-490e-8f29-d20af7397a8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.164.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c382e206-70b1-4f30-bc10-760e6b1848db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6881b229-f2e4-4c34-bfff-fc626895b519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fe2a0c-1f6b-473e-b34c-74a3926eaeea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4548eca-1cac-4873-87e2-6eebffdc4477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4251013-6480-4046-9918-c5901e8ed559", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a6d986e-1ccb-406a-9c13-3e1aff33e069", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ef0430-0171-4d30-84d5-1207d7f901b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a774de-1799-444c-b07e-41b731a6b827", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fa2dd94-99a4-44e1-868a-9ef2cd1a1766", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547f79b2-16fa-4b13-a579-991fbcddca75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1184fbca-747b-4ccf-afc8-1ba7474e2fd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86f9a803-2c2c-43a1-afb8-65ae81091821", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75b40caf-7410-40fe-a292-10d5903a5784", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee7e54d1-0b82-46a8-831a-0cae2642924c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e87d756-4162-496f-8cf9-b77799ea1e33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.172.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8f4ebfe-a1bf-46c5-826d-27bb221ebbba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4befa4f-f8f9-4705-b211-3bd113e2bc68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f03bcf41-e096-4696-ad54-35f972b0e68c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d6311c-7b28-4221-8d49-aca962d53038", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--558a7ad5-7389-4482-86d7-4d396a5030a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.173.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116240db-2469-4b7d-9027-09a0c730372e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--580d093e-39b9-46ab-8091-54de62c4cc21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.174.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a174f5d8-8a87-4675-96ef-4ca9953fe3ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.176.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a064230-057c-47e0-a4fc-9e359bc5c968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.179.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d201de-9ec2-482b-846f-1de568f6bbb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.179.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45a3ce7b-614c-4e3b-8c1f-a55073917bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4ea5c9e-20fc-4e6c-8aa2-8be0e52b69cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc4ab8a-df3c-4672-b15a-524c800480e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a21769e-5266-4f75-821f-7b604bab473a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d619774c-993b-4761-814d-0e165cee960e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.182.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2692274-3b32-4a3d-b1ae-aaeeb1631b00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.187.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da592d4-12b4-4fc3-9855-4f40ea48ecdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3717f0f2-b736-4c8d-8738-9156f60c0c5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a0899a0-acf7-4da4-b859-63088586f975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8afaf541-0961-47a2-8115-02b450bf8eda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--573bde41-805b-4f23-8038-a0a0679fe341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94991cf0-3678-487c-b85a-16073e6d6d76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.206.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e2d6b4-e328-420f-be50-e9b280892fcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5116cf1e-21cd-4e7f-ba15-5c6dda03f469", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.218.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d4d235-cbe5-44f4-a1af-4d853f5b07b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.22.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67728f5a-46db-4c9d-b829-9a3a1c475584", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.221.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15fbfb34-07ad-4a13-a09c-b68a6d405ad4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4a9a994-85f7-4668-9f8d-43cd32e03a58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.29.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e662f14-0b8f-4e64-b612-ec2add1959ce", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.33.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d994ad1-b7ec-44ed-a33a-49cfd34aafdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50004bc2-d2eb-458e-bb91-ef08bde9d602", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ba4924a-35c9-45fc-9ac6-454762cbb641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b640d619-a5bf-4114-b77d-d85947f200d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.36.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57a7bfc1-d48f-4291-ba49-5a43213b798a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547bdaa3-d026-4c25-bf48-41d2e085e3f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6281a8d3-d8ca-49b2-b906-21a438566a9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.40.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a1bb383-82fd-4d66-86c5-b31279ac87b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e09fa5c-53a1-4f7b-a9c0-8143d668cc4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2290a549-0751-4ee9-b0f8-de4d8152505f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aa1c5f3-0b41-4abb-804a-5a15ce48e5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db78e1f-49a8-4ad0-a058-11df7b1a0a40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff6d4295-84a2-4e01-90b1-f0077e902bcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.41.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3db052-9195-4f9c-8321-90ae4b67521f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.42.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab09940f-4e11-4033-8e2c-ff706b33245f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.43.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c2a404c-84e8-473e-8aae-f1855700d556", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.48.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e637a24-62c7-4cdc-b21d-d0ba220eb004", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.49.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d11232ca-98f7-458b-bd6e-702a8e207077", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2a3beb6-1a38-4daa-9d29-2a04618be3a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a3befdf-f479-4c8f-b916-a4fc8f8fb08c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b1e338c-c8ce-4b83-8d7c-56e0255fd1aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e1fcde-8f2b-44cf-8d03-ce45ab496e49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14071da4-48b5-4ff8-ae26-25f651734157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.51.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e164e894-114c-457c-a562-e233a3c7bdbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.58.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff5130ac-ab17-4362-9d54-b9730ca194ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.58.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f70a196e-eb70-447a-913c-92a4f65778d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.59.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdc7be02-2cc8-4cfd-8bad-c676c42b21b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1d9801f-fc94-45b5-bf8c-ee57d1ab489d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.6.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16358e49-8180-4839-8f73-68c199f9017a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.152.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b63e1b38-d45c-467a-97ce-96e8c564deaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.89.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84ead3dc-64f0-4585-bb77-b996994a51f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.119.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e411458b-38ca-40a9-9c13-3621b29cf3d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.134.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94f6929c-eb70-46d9-ae34-78220a731107", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.227.72.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f2ef56c-16c5-4f44-bc61-752583d88468", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.137.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a5738f5-c180-4614-a711-467d12751d07", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.232.169.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee1f6dd8-2c48-489b-9522-6b83cbe3a894", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.184.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08deb22c-4616-400f-81f3-51c270258356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.246.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb81720-03d9-46c1-ae9f-3f08e863cde3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.109.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2c237d3-eb53-498d-bb99-4b4a7422103b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.142.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f5bb007-2b0f-43d6-b109-d792bd08bc28", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.172.152.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--413bba96-147b-43d5-a9ce-5b6116f52147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.235.26.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b334c02-02ff-42c2-bfb0-dcc803637316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.56.113.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc79906-cc2c-4859-adbb-e6a18ce3b0fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.62.122.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a4b48b8-e1d8-4696-ae10-e22bc927e302", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.102.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19ecd9ec-da17-4883-9ae4-fc56d3938d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.11.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bfcd91-3d35-40a3-ae70-5c136f3743e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.229.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c08b6685-10e0-49de-a1e7-782e44d9c1cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.239.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e04c257-9423-45ad-a9e3-be4f02b2ca83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.47.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41580b7e-342e-4e6f-9662-72c3b00ddd4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b29ffa1-e1cc-409f-b57f-89cb1c9d4eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c04d1976-6904-4f8d-8658-0de73499389a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2ce5be-07b4-4ba6-b931-f35afec076bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3993b67c-7d36-4ca0-ae86-7a296123edf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ccde5b-d62e-4376-8b88-1d5ebc9f1a94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a8d32e-fd58-4390-a0bc-a99ce4ff3c53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d45773d-9bcf-43d4-819f-e442e9d95927", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f051a7d0-f13e-4d2a-853b-e48956f80f16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--404a22f7-3a22-4f0d-a8b3-a8cd73839bef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e146029-2ca9-4dc4-95b9-ad137ed1202c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d41f1a-7d94-4ed8-b408-0f5bfc973560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2bde2c2-43b6-4ee2-ab69-41b4d7e3e0a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27bbbc8d-36a2-4637-bffa-a9ed6efbab9f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b797ff5b-d90d-4bfa-a5d9-5230d69a1260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.145.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c8a23af-bbd8-4a3a-8832-b40e9df1d6d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d40ca271-a23a-439a-80bc-5897f0fa4e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c4e413d-6bfa-4e5b-8bbb-44b43827fb1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70c4d849-b5b8-4185-9010-f4af4f0218cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27503f02-8ee8-4219-99f4-701847b34712", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2685d92b-36ab-4a2d-b479-f33072dcbd13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad4a8770-bb2f-4742-9bbe-c7ae51db7760", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c90c7067-25b5-49ce-b7f2-932934475724", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c4e3df-79cc-48e3-90aa-9d8b4b2e01db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7815f4a2-9229-4c38-8cf2-8cc913265a30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843926f6-2ce6-4a98-84a4-eebc81e96522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c69206-c223-4210-85b5-42cb6c3f9ecd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.94.146.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4baa3d-08d1-4edb-98a9-dde98872a60b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.144.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b178a80-70ac-4aaf-8cb2-4c58508a070c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.172.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c41d96af-cbda-4bdd-83f9-efbc8ec290a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.221.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ebca072-3962-4614-b0cf-7ba1520e2506", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.99.234.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a73668c-0ae7-4239-baef-c34c27b9631f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.110.195.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3884457d-9527-4e07-9e1f-dfc5adf346bb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.138.213.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d95005a-7c67-4eb8-b120-baf2cf5e1cfd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.95.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d97483-6b92-477b-b4c7-8fadf20c1046", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.95.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--044dc7fd-9879-4d99-a5ff-9822cbbfa81d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.181.178.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b509d30-e6c3-44e9-8385-5d33f612fcb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.196.206.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1befe6f-6218-4ee7-b18d-8e86d58aea92", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.224.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f2590b1-50ae-4e2b-8ce1-8fa4727390f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.197.250.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9789424b-ae0e-4fc4-a29f-908545eed740", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.76.131.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b337d525-19f3-4f88-812b-329965f1eaf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '169.239.181.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4f1c6f-1d54-477e-9f51-7e843df247a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.107.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--272d50fb-7ad8-44f9-a617-425c7ec4e1c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.64.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaadccc2-f5d0-4314-9363-b128368ebfd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.130.204.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26d225c9-4f9f-49f2-bd2a-9f0c7cf621cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1a99543-f8ca-4d4f-b157-ec72f24efcd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.163.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c88d47-7f53-40fb-bb9c-a7442b186af9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--442c3669-8be1-4a98-9e67-7fc655364cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ddd3f07-d92c-45c0-be9e-7709dfe71fd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0a461ff-b1dd-4874-bbbe-2cc7f19f7b29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09230a8c-3744-4c81-adaa-307008bb89e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9606dd52-775a-49fd-aced-41f2bf0a1b94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.187.165.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--585daf88-1655-4ed2-be10-68a3d26320fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.254.210.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89daf3d3-ee69-42c6-9f9c-d24794d5c9d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.166.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b5da0bc-2acf-4243-8ed2-f6906d7873a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.64.167.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7677244-b69e-43cb-a3b0-bb6f06b7a577", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.79.37.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--894c791d-961d-4361-a289-e9b7266a70a9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.112.134.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d4b1aa9-212a-4a94-aeaf-e99e6a763d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.120.30.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa084a3c-0207-4224-b22d-c2a1b845c445", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.231.177.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8796c0ad-ee6a-44ce-991a-8d933553f5b0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.243.148.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c43e203b-78d8-4add-a0dc-6a184e43cb19", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.243.151.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94c62b65-bb99-439b-94d1-97355bd3ef69", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.143.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5427ad8-43bf-4835-9bf3-c262e023f558", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.37.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c067421-db72-426c-8c54-c45018ef2972", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.25.158.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde0a19e-1c00-4cb1-89a9-de8df753a0ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.67.71.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c760f7c2-4be7-40ff-ade1-752054da7202", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.11.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60e7ebf4-6be5-4713-b271-87119bf6cd80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.11.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56cfadc4-11c4-4c9f-9714-08af71872114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.19.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9456c2ae-8071-4b68-adde-66c4db443e90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.104.210.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--380d6003-d366-422b-9376-263198e13a68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.128.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12cec4fd-7606-49ec-a146-931ce0e67708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.197.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5cd7d86-c25a-467b-bec3-7e4cc7e4d943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.105.218.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b98f916-6706-4c01-b893-9c86c376547e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.221.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3ef1e0a-7aae-4647-b2e5-060be26f2b03", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.172.131.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5a4ea6d-fada-4c4e-af66-582db10b44fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.225.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773bce9b-4435-41d0-bd07-9f23bb3d69c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.236.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9618c073-93c9-4a76-87ba-cc8d33c1381d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.244.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5a82112-e73f-4a14-8e0a-1b317fe27a06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1e07f5-0a45-4fc6-9394-450725cf912b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.117.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4885d8ca-b983-47e2-ba6c-8f234526de8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c4804a-d604-4ff8-a56f-da0beb45e337", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe5eaae-c3e3-4520-becc-1163d47a7f5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a50abbca-710b-420d-88b2-10be56b79cac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e1d4e1-c0a5-4c20-9ddb-a5a8e36bf86b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.118.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e287f2-fa6a-4675-9a9d-f229df1ed98b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.122.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afad0bbc-0b81-4249-b164-ce464c3c5761", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.202.92.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc0f517f-84a5-48fd-8629-cbffc7c18568", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.206.224.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a68cd76f-5a6b-4819-8fd2-a73d800f1f75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.25.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c6fa8fd-a3d4-41de-a204-0f3dbfca008c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.208.49.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46fc195e-e087-412f-aff3-2984f5bbfcac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.210.68.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94ba1c3c-4ad6-4881-9fbb-6b1e2e89b853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.200.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5013d6c3-8dd6-4e65-9f33-1ac8ba0964fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.212.224.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ec4561-b4cf-4cf6-b415-d703c61d3f86", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.219.26.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ff06c89-9807-460d-b38b-6bfdf564ea2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.108.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a306500-58ed-437d-a77f-997426ef27fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.143.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43bef25c-64a8-43c2-a842-990933f8740b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.15.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35251dc8-4195-4c6b-a93f-1b2c0998b0e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.27.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb8031c0-8b2b-4e39-9325-0f5d26d26e10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.3.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd597871-40cd-4b8c-91cc-bd26e5bcfd02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.232.8.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a8d7fa-957b-45ba-9e04-af94875f3752", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.219.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80b719a6-4f08-4fa9-8f65-6a7010c23035", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.233.221.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff7bf2a-74d1-428d-98e2-c22cf5a12cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd569d5-57d9-4871-a8e0-96421d862521", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.192.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6c52e4-07d0-4199-9977-4f77fa73a525", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--163550ff-bf52-4dc3-9c17-04d07dce410f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63f69c9c-984f-4fe1-9f9e-c366bfde712e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db75b11f-fa55-4a00-aedb-7b99604d6a26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.199.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67cf3213-6ba9-42ca-92ab-f00d75d41d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.21.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5da1f9b5-1f95-4153-8f78-0a97d5576d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06ff55d0-1539-48ec-88f3-0452829a86a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dab4647-a2b3-455c-a7d1-ab231223c376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39e93d7-b776-4dff-8257-1aef19856f11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc0f5820-f967-42ae-a3df-e32b1da43a69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.218.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--709d0df5-700d-48a4-a52e-4852320c0939", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.221.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--688b09e9-8cd5-4d91-a999-aef387f559a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--170aded4-f089-4913-87d2-b8d759285561", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e36dc1-9a80-464d-9aab-258816cd97aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7c07bae-b82d-4ac1-9bd3-e20a41dfde73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.234.25.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3daaa036-904c-43ba-b56a-d1dfd15cbca6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.235.41.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a8a5b62-9dce-48c4-b3cd-956179a79a91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.106.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16a705ce-02b7-46a8-920c-48a2a516b995", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6129db-81ca-44e0-8a87-ef9dad062b22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b88c8af-267a-495c-827a-de4a41694042", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.111.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99c2165-a0a0-40e2-97a6-95ac23ab5153", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.117.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9aabd20-a238-472c-9276-be98b925046f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.123.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--978014fa-2c11-4e8b-a3a5-ae9c1c892de6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85e12c27-1698-4c47-a9a1-f0b784c197e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.126.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--530d7c28-c9f8-403f-9755-f40a5332550d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7639a240-8971-4970-bfbb-4431ab1c3c7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.22.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1fdd76f-03bc-4fdb-ab6a-54fcd52a7f55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c546734d-9b18-4941-b88c-6da0cca2637c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b04378-6cd6-457e-a72e-780c712cac2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6320f6-4d65-43ec-bc40-c737b7c11c22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bf280bb-6a97-476e-a317-35ac7e429a2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e7fd0d8-11e9-4f20-9851-872536137bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd42fe18-44ed-44c2-8545-c7583944f53e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.228.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67298bda-14c7-4618-bd4a-40a209104db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.239.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a622f766-4fb1-4b2a-a471-8555db96f323", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1a3ee1a-3ab5-454e-8db1-4e33e48e4f6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.236.96.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2faaddc-85f2-45fb-af14-8b1d9edfd82f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.104.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17132ec8-733a-4dab-a54e-b2adbf089661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.114.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce6c4555-4f9a-4ecf-a259-c0dbd4a50ec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf857af-15d8-4f4c-be4a-fdb1b72a6501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.136.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099ac778-beb5-43b3-a9e2-1e844aae5dd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e683b80-9d37-4072-9cb5-cd57365f80e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.150.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad93b43-9f24-4d8d-9de3-354198400ebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f93b734-a318-48ac-b459-acb508d7d9d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.155.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b19954c-a74e-4c1e-b2de-b22d25be9f10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--935051e4-1e29-40bd-9c2a-243b1bbc1c8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.156.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c558f6e-4eda-47e1-8080-156451f3cb95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.160.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74611759-1d5b-44e1-b705-6feb36a2f39c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.171.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1d141ff-76de-41e2-8f9c-1b19291925be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.238.188.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--901ac5ab-70d1-43d2-ade7-1760c24e513d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.15.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99692a3-d95f-415c-8354-af40f41c9b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a57cdbe-614e-4624-8729-2807a2b2c510", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.51.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d3f995a-b99b-4554-b534-352dd1e4f088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.239.62.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1249e762-182a-4a43-b8dc-4549f165d50d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.245.180.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aa4abec-5997-419e-acca-f7251d06e2e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.86.88.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e33c06-7126-4b90-be53-b2e069dd332d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.93.103.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c241bf4d-e77d-4b13-acc8-35af8a5ffcd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.94.9.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b479a43-d49c-436d-8197-5f27df119500", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.197.14.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1198473-ccb6-458b-91cf-d54abac54e37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.117.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb599c9e-044b-4480-9ab4-28cb55b2c82e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.199.92.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c3b5bc-1398-45f5-b2fc-5bd105db118e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.206.5.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4ca491f-6644-4823-a46e-0b94bae17600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.230.150.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0c56a43-8303-417b-9805-66ba6feec08f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.210.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffa86fe0-5450-45f7-a354-f674c2618a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a281b50-04d1-4aec-9fd1-9d79ff8264f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.221.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a5c1ab7-925a-4182-bdfc-01fd0a201e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f41e43c-a73e-4014-b029-36195a821a1c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec172b7a-a23a-4507-b68b-eee7f4a57cef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--244d425d-1d15-4455-9cc1-444058cb1d50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce21b547-a51c-418c-9883-b38bfc91a083", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b900a81-0034-4270-a197-e6cf545d67bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6895ef2-def6-4ac5-a7e7-4b016ef96afa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6343e3ab-770b-43a2-b527-97d4acbb4cbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4071eaa-b080-43a8-8865-188fc8db0c84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7df0d1-0e68-43ae-bfc5-15d1987b34d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.223.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f55e9f8-c403-4469-9a3a-e5d1e30a5d0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.242.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--885a0c81-4018-4de5-bbcc-c4d5f3ccb039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.255.243.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4550510-1c60-4aa4-8754-f7ec130a0f53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.138.91.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b84f997-daa9-474e-be41-3d6780304f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.0.135.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5daac41f-08c1-4fe7-a9f5-e80b3b62c440", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.110.115.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d5e0d82-d74e-42bd-bb70-5bd7cbddc474", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.171.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eafd7b7-5239-49f3-b8ca-1fd13d205a17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.30.48.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f70f26-69a7-421e-9bc4-4589743f0f26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.45.194.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c81806d-5cec-490f-b410-2c2c0a17a4d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.120.22.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6c4551c-2654-44dc-bd8a-642b3acd15fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.123.2.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6941c644-c997-46e9-b21d-fc08a4f74154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.123.2.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06603f45-80e3-4004-a00f-7b466604d290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.29.4.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab01f007-7bd6-4247-8947-cbf8b6c28755", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.32.193.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--438622a5-e076-4410-a4fa-f5c847283d63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.131.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13245e95-343c-45b6-ae3f-724ddf5787ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aedf32ca-7016-453e-9b53-50a08cf2b746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.132.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05309091-b387-4b2d-8552-165e6be590b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c1775b2-9175-48e4-a545-b084ce9cda4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.134.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12dc2097-0801-43b3-8344-a34ae128742c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c6fc55-55ac-423b-9d49-c7630aad84b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce72907-4976-4a6c-8cfa-1ca9a128b67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f48b884e-098a-47dd-908c-79782e0adb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd322a9-f689-4edf-9356-15faef89d73c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcf6fcbe-2575-41e4-8dcd-4f3ec5cf4150", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46580213-eee9-47f3-af84-2b7ee1f09979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--326f37ee-704b-4f7f-bc75-763b39a14cbc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d8e490-419d-4f33-95c6-172d5ca20b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe8550d8-ffe7-4099-8195-7bf96d1ed1bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e64b199-27fd-4777-bbfe-cf5c3d5e07d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7499cc26-f091-46f9-8fae-62ec8bf3e3a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77f8a5f-7192-4554-9b83-e1aaf6c6de2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--322c46c6-aa5d-465f-9aa5-288de4bdd406", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d56901a5-2ff2-44a7-8b62-6150578a99e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8fc546-aacb-4a4a-aa10-df22103d099b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91d3ae41-55aa-4698-b9cf-c1d0b10d42a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aabc9bf-514b-4e21-99cc-d7725f445c62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c63036-e8e6-4ccb-8897-7ef4d6c115fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac87c89f-b4e2-4929-8f67-43808f083102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--454c4071-ce1a-4c12-8d0b-970f110434df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.139.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463dc40d-109c-4f6c-9253-875348b6e3ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e22f0d6-fa3d-4bb5-933d-69d70c174182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9cde093-0472-45e5-a6ce-a7e5d53276bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9262e7d0-0254-461d-9566-0cd1f9f3e2e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b69121a0-924e-4d41-86e2-28d8ee3f9bd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4643827-995b-4e17-ae3d-863c9450fb6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf0478a-38bd-4374-a9cc-08b3258e6d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754d1e8a-11b1-4c6f-a17d-210c1add1818", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--867da7fa-1e75-4295-a0e6-4650049d8b5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce90000e-ae9e-49b3-8bfd-9a7c6c9a0fa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5a0869c-ea51-471c-a1e1-f186da1d9c93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d054e665-50c9-4613-a6f5-c60b6da36c87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--047470b6-67d0-40fd-afb7-b69064e81c73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15df675-7ab7-4f56-b4a9-636e726f0e43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb7416ce-b697-442d-88ff-be1964c27022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--119b5a9c-8994-47ac-a5a2-dc710872a73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.148.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e99bfb0-caf9-42f3-81b3-8a24093400ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f622078-0da9-4781-a318-a1d7dba86b1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12d31bd8-ae36-4b02-93b0-4c376d960623", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a4688dd-ab20-44df-af9d-a242a8315b40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42d89e8b-fc87-4f8b-8ec1-ee5f569d4511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44f3c805-c9f1-4f46-a13d-918d3dac6fc0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b465f5-080d-4b2c-9029-ac55c438af97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a22b08-decf-4c2f-859c-f4ef52a45f67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c461de0-750b-45bb-949f-7ff3c59ccb9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.65.149.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75fd7599-c89a-4f74-8661-87a00008a233", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.200.149.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--407968cf-a755-4199-a809-ebf9621c2147", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.22.176.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f76c550-1a41-4f0d-902b-55c1eee36ff5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.72.57.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--856b2666-9bc8-4d5b-8bc1-bfb9247fcd09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.86.229.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b4c571-641e-4c38-ab95-d533e2d8f51b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.96.77.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15014991-f8c0-4441-a866-f2bcc1e2415d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.107.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ae3713-edc3-4e67-9c0c-8615e953f1fe", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.114.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d95566c-c219-4cf4-ae69-ae2b3aac878a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.173.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab07366f-94f4-40d3-807a-ef8dfc32710e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.105.212.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e90538f-4076-4ed7-ac2e-008578c62576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.185.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2e6a60-ab6d-460e-8df1-d2520bbbaeb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.225.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c117e53c-542a-4ae1-8bf7-2033cf2a6f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.84.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cf278db-61a9-45a0-b83d-8d6e5fa17834", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.53.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f23b295-4a2b-43ec-a35c-e694426f7d88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.54.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1f75a38-04f8-4404-b32d-800acd0f72a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.16.54.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996a0099-0215-4be2-b824-ea918bace576", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.185.223.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1c9be7-903b-4677-b42e-f025b832787b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a63f61e0-4a46-42dd-b28f-8e2cfdd6b6c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6fb9cc3-852f-4f00-996a-5a227e67d516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.20.210.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceac4f59-c360-4d99-9c6d-7379ef138cac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.247.214.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6f7ba0-6402-4e7f-8614-11e962c49315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.32.156.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b555e07-adec-4548-88c6-634761c220f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.62.55.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4447313-20fc-46fe-b76f-284127803a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.125.194.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d15803ed-b618-44c3-b4b2-44876f5d3542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.25.32.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e88f7b60-202b-454c-bb36-3f0e5855be85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.146.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e7feb82-cbac-4574-a001-b6839250ed27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.168.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52300f42-deac-4d0d-9061-58b75357b2e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.54.105.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a944d7e2-de42-4838-bc66-4f08eb623866", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.57.170.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45f236fd-c045-4561-a60f-46daf8792a1a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.117.240.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--290dd6eb-91d9-495b-891d-16d703f877b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.119.209.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc0c8b5a-a69c-497a-9042-3dc9d8de9351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.143.235.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca29fb66-5165-450c-a4ba-71e0784fe935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.189.74.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f709da58-da0c-4d5d-9a24-bdea9be8d0aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.190.15.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c8b816f-f6a0-4a86-9f98-97810d06d810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.206.156.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ed45840-e062-4d15-87e8-3eabe822f5bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.209.56.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acc7f6b0-0bcf-48e5-94fe-71135cfb070f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.212.83.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e5baa87-af5d-443e-9604-0790a6a1fa6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.217.208.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb4cd1d-0471-4f39-893b-f1ecd0d9dcff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.179.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9217dd49-26d5-4d83-983d-a72b14228b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.221.195.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a6cd69c-e38a-4954-9439-8d8c68cb249b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.225.72.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b39c70-8ddc-43ec-8e69-d67e0f19fff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.234.209.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bdf26a7-1530-4dd1-bfae-62875508a27c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '18.97.5.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a645d57-7e99-4dd6-bb77-7b532785c9c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.111.30.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91ff412-d631-484f-b0e5-d1056ecfebae", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.127.26.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e09dbcc4-ec11-4796-bec4-ebe5e91da21f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.153.197.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--896bbed4-aaee-49c7-bbb9-ec9aeabfd74e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.153.197.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4a08d01-c33d-4c16-a23d-b69196d1add8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dda23fa-aa56-44b3-a72f-1abf256f6042", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.167.128.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--376d626e-50ca-475f-89ec-1f746f0dd6a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.173.123.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5298173-3825-4d19-bf86-75d356a6a142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.182.229.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240bd14b-4692-4e0b-a901-a6deebcaaa80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.184.86.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18ee197-b2ac-41ee-a5e6-d109046a0d0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.210.128.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4485f69a-980b-4da4-8b66-160dfd4722fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.243.32.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9e290a0-acf4-4751-9298-3adc3c24a861", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.255.97.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce3ce04-6260-41b1-9ad1-a8cec47c8d6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.76.172.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2276dd3-c804-4a8c-9ef1-5467e1a8bde1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.93.3.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6191845c-182d-4696-9d04-498915b9228a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.95.238.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a34cfba2-20b5-44bc-8623-0dc9f92a6fa7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.116.220.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fe3a8f7-60d2-4f63-80c1-c3e98c62cf3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.126.187.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afb49d05-2310-4730-92a0-f45a8f610e7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.178.231.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c56f73-485c-4754-a6b9-589b97e18bae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.41.194.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9da2e558-2ec2-4512-8366-a41300accc0b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.48.91.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16f4b12-a215-4445-9b6f-809908488502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.119.226.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94af07f9-d321-4a3f-9502-2865c8862d85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9946d2ea-6076-49ea-8836-d2787bbfc182", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.138.158.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--926f0278-762b-499b-a696-3a8e6a5c89cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.16.3.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--468fd63d-83a0-441f-a488-43da84d10aaf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.207.178.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16924528-dddc-4615-be84-58540ef3d580", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.242.168.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d3d819-6305-4383-9356-1f2c768404fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.253.240.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a83afc-3309-4361-a531-90fe44f9d4d1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.53.222.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55d6c47d-b1cc-4737-aef2-979946c1d2a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.54.23.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f4ed4de-c9e3-4785-a947-81a95adc260a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.153.79.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10086d04-4096-464a-a3e6-707efa71671d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.185.108.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35fea427-1e48-48c1-a74f-7b5e6e725789", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.236.101.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--440f483a-9222-4b1d-bf21-fc51b19cf7e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.36.35.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4842225f-3efc-4a38-a417-e8a17e7d95d8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.81.86.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d36ed26d-61eb-403b-b2bc-ef3090a89942", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.186.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad498371-d1bb-49ed-8a81-f955df85f0bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ceb2ee-be8b-4504-a7d0-0b92ddd3ebb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a29d70e-b461-49c4-8c54-fc2e53b08605", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dababc19-18b8-41fd-9e49-415f52b2f6be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abfc4989-244e-4318-8629-8028275c34aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a91ebd1-1ce7-451d-9d41-cc517a0e340d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b219ad-b8b4-4bbe-9997-2dd939817eaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b288526-8eb6-4313-8b80-f8699538e872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9e9e14a-142e-4ec8-bf21-5e2d54aa0886", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5750b2fa-f0a0-4454-8155-74513a2aaef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fe8b779-a569-4100-a42b-5b97d1289e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19e31aed-a589-4217-8dca-fe7958db081a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0398caf9-1156-4dad-a0dc-61cb36bbf0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.139.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25932184-0f17-4e70-ad89-899dc15a6bee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72bc7fd1-bbbb-42e8-9d4e-abed0704944a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01de7c97-bf4e-4b12-b2e7-71583a66eccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37d51a2-01a3-41b5-a221-f1fcbd7d94d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02937370-ef4a-4f93-9242-713d3e04fa39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01ab0d9a-ce04-4d2f-9682-c08632c84881", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429caafa-8a99-4b3e-8690-ae766e90355f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe87352-e21c-44d9-bbdf-23a05d0a94cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad7e43c4-51d0-41a3-abe2-fa8e68c05ce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42c5aa0d-d4ca-488f-820e-07b2d1ea13e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9abb2766-1333-4ab2-b04f-5d15a8ed7db2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de8e81ca-5f47-4ac0-9abf-50acfe88d6b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82123b8a-76fb-4f39-b2d9-ceb8d578cfa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89753a70-9574-4692-a213-58656f980f0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575c21d9-6e3f-4dc0-b2c1-aa59e3dd9d70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84a4bf4e-25ce-4686-8921-09480df53398", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.105.247.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074b21b3-8056-438b-b149-2300a95cd8ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.107.179.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03da707e-09ca-417f-99ca-a75b5668295f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.153.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9538fa51-8cc4-4853-848e-6ef2cb556840", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.156.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddbdd1f2-6793-4e6e-92e7-6210805cfc86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.157.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ebe6ce-210d-4e56-b159-2d5f07b97c6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.154.194.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b0b1944-bb07-4b6e-af2f-845325ec7bb4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '184.168.21.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a633dfe-b291-4a66-9f78-3ef0a173b62e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.100.87.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4c3c2ef-13e1-43ff-aa32-45d49fb38cb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.106.29.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60eeabdd-3bbb-49b9-998c-d0a429e1f77a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.107.80.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3215626f-db73-4056-ad70-117b573b919d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.12.59.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42812c33-df54-4ece-8a8c-9e3032b1477b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.132.187.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c057e2-1dc8-42b9-876c-f3cac8a565ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.134.49.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--634fd2be-b650-43f7-a554-430b023613ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.142.236.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22fda037-ba9c-4c30-a37b-79dec3501062", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.150.191.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c715ac9-870c-4132-8890-773c70ae5278", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.180.141.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de239ace-915f-409a-bff2-e187a2797887", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.183.242.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3dfc9ed-d824-4dd9-a673-a3c5467d6944", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.188.217.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db730885-e535-4ec3-99e3-dbdb82a8b2f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.188.29.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6eadc70-9883-426e-9328-59a7a964e70d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.189.182.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c85e7675-c473-4190-9408-9ae1a382f58f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81beef3a-57e8-48a2-931a-f349089b7c43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff59b6ff-7fbe-451e-ae3f-bb0790aabbbe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53eaa6e-491e-4f61-8e73-9ad1a5d9520a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4a9e69b-182d-48ea-a4a8-f45db20e863d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f432a9d3-17aa-4e30-b6a2-23c9f395ba85", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ed2898-f761-43b3-80a9-3437819b3684", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db1e3c6-00a6-454e-b66c-e4c365ac26c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40b36693-b290-411d-a46d-e661086bfb17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61fb3e33-afa8-42d0-8423-77e2a902a621", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9df23e-f683-480d-b616-c7e768af6ad6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88f688c7-dc2b-48f2-8438-3001c925d316", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57db903c-6abf-4295-a2d4-55a1b52b14ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4d12d2c-9e61-49c1-b3c1-28a117c006d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dede613d-96fd-4c6f-903e-d1e4bb01a331", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--315ea5ed-ac31-497c-a85f-4a1aae5be8fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0fca92b-9483-4c20-b4ff-932115c38593", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d7a8854-3236-44b2-bf78-63710e583ad8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb690f9-f3b3-4a5f-8f7f-c7a5c366f49c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f99dcee8-64a4-470d-b171-909129b9f411", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.193.240.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9656f1-0233-4378-a926-ced94b722754", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.194.204.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6237d1bf-b597-4bee-8ac0-708c62bf4313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a406135-0e9b-42dc-afc7-51ed3c78cfce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08fe6522-262e-4333-911e-6a9fc1c17be5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8785cb4f-62e0-43b9-8101-e5d7bfd11f94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48f1a093-6cd8-41c3-92ca-f95b191a8351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412aa352-2893-4454-8b7e-4de3756ee933", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ff7945-b34c-4595-9f97-64393527e35f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fe830d6-641b-4d7d-a195-079cb8373324", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.200.116.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ae688f-ec3a-4674-a03a-b3ff4c30bb4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.204.1.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4acaadc5-46ef-4072-8da2-e38af364321d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.220.101.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60801923-e9dc-44cb-96ea-7f3ca7a04f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.222.138.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c5f1f5d-9429-4c33-ae93-5ca94eec264f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.223.152.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fff9443e-b4c0-4cd8-8297-b13ac9f330b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.224.128.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2d93df0-1024-4797-b4d8-ff13567a8358", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.196.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c303c2d-b9a8-48ee-8671-6592f04c28f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c21ec9b-3fc0-454b-b5c6-191f77034f6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e455162e-a906-425d-b323-5b94667060af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e74be5-ee28-4345-8ad3-10653bcd42d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f340a7dc-a39f-4e8b-90cb-bd11b5a99114", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32ddf223-0c24-43e6-9dc9-820a928514a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.198.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e5f65fe-4ca0-4f81-b545-f84205188756", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.93.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c125ff89-a85c-45ba-9ccf-919224fb6b0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.93.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc1a750b-9329-4ff9-a966-00e4769aaea8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.228.72.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e513544-5230-4e7c-be26-e6b17c21d2d1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.239.84.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--484aed03-a69a-4d64-9c22-eb55739e9392", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.239.85.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0382ff3-1729-413a-81c5-4ebb53eaac6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5597f5bd-2907-4df6-8ded-98df54853230", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.241.208.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39be47a6-0062-4b5e-99a7-87b3d2eb16d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.106.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f014b127-614e-4014-ab59-5ed101809a3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4681b81-76dc-4453-b78c-3808e676526a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--365db797-9e05-47e2-9dee-ed88768dbb66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c9e03a9-43a2-4fee-bc7d-4650067c8b41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cc19772-4fbf-4b37-ad80-e52f80142e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15780ac0-e723-43d5-8cb2-cfa19655ec77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff4846e9-67b9-4109-b026-2f54e373ea81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b621b0e-059a-4475-b8b7-b4a16f30ee0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f068bf07-de09-4433-a83e-ac9aaa16a5d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835a3db8-1895-4af6-916e-40688997b2eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de288124-addf-4c4b-bba1-afd217d97dc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36aad525-3dea-4ee4-bcc7-8e088f7c0fb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10ec975a-0c9a-4e34-b123-9bebe368e406", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ee54329-06cb-4812-af10-5758f16db121", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.226.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76eb4814-df36-449e-aff8-a67eb09cce62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecec5b7d-7b04-4da0-a29b-9b75e244d409", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d815abc-b26c-4924-a10f-70eeb32d8e37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c85ceea-15a1-4eb2-888c-746ae15c9123", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1949c8e-f201-4fe1-9c80-2e19e0aae78e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.242.3.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91aad7f3-427e-48d2-98dc-8f1301477cbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.246.128.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b5f638d-6750-4b7f-a478-96ac5bab8265", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d620eedf-8a50-4538-9d82-dc2ccc1563cb", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.247.137.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3b63ab0-1f33-4646-a665-4f3e3aebf351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e250c5-759f-465a-aaec-b28487ac388d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.255.100.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81429af0-6309-4850-a0d2-d544f4cf5f75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.38.148.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09d6814c-bc38-4b43-ade2-ade61e2efc61", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.39.204.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc61b2c3-5e56-4d79-9f60-943dabb29243", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.65.107.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--437aa213-ee3f-43a4-8c0c-af5ec8d2f761", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c366aa39-2162-41c3-b73f-2799ded339bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b7fa0a-5034-4d0f-b7ff-a0cde627629d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.93.89.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28018ab4-a1eb-4684-b4e6-a1d857d03bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.94.111.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9381e3f8-a80c-4a4f-aec1-06732d363ce0", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.103.221.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6a5830-c226-49d5-bf9f-9b5c0271d402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.121.253.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaf79d0d-0a2b-41d7-8970-1465a96dbc53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.137.131.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25520c30-7dd2-468c-ad8d-baaa5f141ec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.138.1.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc90a97-afac-4aff-ab6d-86837c82b180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.182.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f47e44-483c-4e36-92db-105edd196e82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.182.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79ef9bd-c577-4b6a-a052-5b01bc49b64f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.182.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1edee59f-3bc0-470d-9996-1688557d2c18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.148.182.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9335add7-d7bb-4988-bc9a-0cff4262c376", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.167.113.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a910959-8a4d-473d-a299-89b2b747277f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.190.215.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df4f9fe5-8a94-4d81-8594-920718b27a13", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.38.26.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2baafcb2-e7e5-41a0-817e-cf8f72af9257", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.5.106.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973b759a-9ec8-4697-ac5e-b48c155ce97e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53007b35-bca4-4499-bcc2-70177341070f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.96.151.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64c6ccd6-b8b6-428c-9cf8-5cd14c44b39a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.120.189.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfa57a61-2de6-450b-b8d6-31cb8670a634", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.137.197.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6acea98e-f7f5-4870-9ff6-a704169bc317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.157.97.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f06fa2-9b9a-46c3-b09e-8c987bc7cd01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.191.2.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f10642f8-8bd2-467d-84e0-74f9ec742bd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.114.68.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c3bd783-fa2c-4e31-977a-ff9a662b5fe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.71.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b7e3c51-52c4-42b6-9c53-a3305b3586ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.187.155.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e22ef891-b3a4-462e-a3c1-7d7fbdd36792", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.243.245.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d24ade4e-fc3e-4ce4-93a6-6a72b463ff0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.250.100.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b689ce2c-472c-4bbc-92b8-fa7e355007f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.40.21.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a0e8e5d-6499-4dcd-a114-6ea463cd3b5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.95.55.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17854d16-1f52-4a3d-b5aa-7f06986d50d4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.202.192.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acdc30d2-1d09-479e-995d-0e5bd91a28a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.232.47.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b0888c0-bff8-4933-958e-7e8842e77e14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.91.158.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ad8efff-0a38-4aa2-aa03-2b82e6b83aa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.135.246.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abfa0a38-ada8-4614-a3d1-dd6316196226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.246.223.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07040054-528b-4143-bf54-fecffac8a1ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.248.248.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4c68e5-7ef2-4d8e-9a1c-a0e0207b5cba", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.5.200.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--293e219a-feab-4e61-afae-44fc2ae8e9b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.89.29.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8fee0f-7b06-4ea2-acbd-64f9c3f4c0b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.97.188.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9cd4f5b-c3c0-4cf3-a2f8-d800dc227096", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9610474b-10e2-49ff-83d6-c9683e8fd5c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.101.33.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9e6c72-6601-415b-8133-8df85809d604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.252.156.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3458a0-6977-4236-bf46-e94e1edc5a02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.109.200.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8689e719-bbbc-4f3e-83bd-145f32ec8c4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.81.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--667481b7-9314-41c9-9878-4b2da97ab47f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.155.84.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e33760e-7503-42e7-8ada-6437383bf558", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.169.201.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6af8efd-43d6-4b24-973c-cc863b8c7478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.195.68.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b261e19-b5b5-472d-abb3-b4492dbfd628", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.210.198.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--757b8d2c-4b3f-4cee-b2d6-2d9a98af8eff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.227.193.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a55a69-10ef-43b6-8382-915821b8ea82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.253.248.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf6395d-d176-4e5b-8555-ec8b0e0b46ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97714922-7a97-425f-90cf-c6ca3b78b4da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.71.211.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c37237c6-c48c-4405-ab98-70ac3a8242ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.142.43.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4973cc7-7610-45d5-8448-c9bd0fae150c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.143.1.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--279aa1ca-b4cc-472f-a710-e2e6956e4c25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29f15e2d-bfd8-4f35-bdd9-7f8c3060ab04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d037620b-d0fa-453b-b581-4e94ecc8e6fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73bda2bb-7c83-48d8-8021-872631a6a348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49e58a23-db7d-472f-b778-6296383809c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d3fb06-45ce-438b-91b4-d963399bb71f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95107081-ded9-43f0-bcbc-8baf57ae4614", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e72ddd1-8b2b-43cc-a10f-855d52749de9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a245cfb2-a6b1-404f-9ea3-3b362a930963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434948f7-5a22-4a62-9358-51ede5800c38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26ad723a-cbac-41df-84aa-6c4c62eb80f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a15333-6cf5-4743-a307-99cb8ba305ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7be8fec-1eae-403a-aed8-577b1270b9b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd7c78b5-cbb3-4ed7-ae0f-d689ed69642b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52767911-aee0-46b1-8fb8-b11740993cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49eb90d2-4735-4a76-bb58-68104da47d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9176f82f-8f70-4df5-8a82-9c3b977394a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6acdee5-1b71-42fe-889e-3db99a68fe67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69f4a9ed-1835-4a67-bc90-1cea89f3b9a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e270e048-0d1b-4697-9981-2efb63f85504", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceefce0e-9f34-4a81-8f25-9e1b62326753", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e672fe83-64a1-4b1d-8dce-0109cc3a3d23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60600d8f-d08d-4087-9898-8d1d17a8539b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a2574d-de78-4f85-897f-d4e7e7707e0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c2fe0aa-4492-4cf7-be0b-aab0e0ac41d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--199d5887-070f-4a74-9e5d-b25e7adad742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ba1db0-0c90-4f31-8507-f0b7b7e54430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--345e96fd-566c-4c17-b415-3a8038e6e69f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e315fd85-55fe-44e2-a7e3-799fad2dcff1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cc69140-0ce6-432f-b904-f36cd2a1951d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66fa1e7-29f9-4973-901a-0fdc0380ce3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d64573-e8aa-46fc-82e2-3a45129981b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--522bce82-39b8-43d7-ac68-1c89ee98d5f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--244f0ee2-723e-4116-a37d-9ad8f1b9c12e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b0ac3ae-4f84-4c88-9b91-7665abded309", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a645957-7b17-4533-acb5-88b5fdf46ae9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16aaec90-d677-4f7e-b44c-2ebeb770ea9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f05ffd-f3c0-49d1-a153-99c76318750d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcb547bb-ea46-4289-8162-36861ce07714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.169.194.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35cbaa3d-69d1-471c-83de-51f6db574d0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.22.147.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db706fa9-a6e9-4f46-bf4e-a480eafae405", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--715a91ad-665d-4769-a068-63c685c052e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6858f13-47aa-48f6-814a-94fc3198314d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a53165e-ecff-47d2-bc05-5291606bddb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38ae521f-283b-4036-b703-9c320d32f3bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--946f989b-fdf9-4deb-addd-7755546da9f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd064515-e899-4b83-9b84-318fe78a8a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94abd5b8-2a69-406f-9a1f-9edca681ad70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2919e362-f3ed-43a2-ad1f-a107e2dc7e65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.3.53.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca004e72-91f0-4129-8321-3b5369fc8366", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5290f07-4bad-407a-838a-d73338748612", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.39.208.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58f1bf89-349b-4d7f-a726-a2d3eecb5af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59e766ad-4d17-45f6-99dd-5b93082a3c6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.140.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee754175-9238-42c3-b968-77aab64eff9a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.43.159.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9127a256-632f-4524-9169-db97c50e4872", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e170e748-dba3-46e5-86fd-93caf77b5f48", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f72b9e33-c5f0-44ec-882c-0facccff60ca", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f4cf553-2e3e-45df-82a8-9ab1169f36af", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7221a24-69d3-4c54-a0c5-a5ee7a9756c3", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--586ad61e-90f1-4bcc-b786-05340f04b9e2", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8b57d37-bef6-429a-8f97-392f744fc73c", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df0eea8-5381-4920-a7b4-3b9e0dc9a5a1", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--975f3280-f3e2-42b3-8330-8171d462dcba", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--816501ae-ac44-47a3-8fed-83f50990ff75", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6699c217-6c63-43dc-aa3a-2bc8444cbb61", "name": "Malicious Host", "description": "Observed: MSSQL, PORTSCAN activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.113.39.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82da4d97-eb1c-4081-8061-73f0b3d50523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.120.230.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d44badbe-ed6d-4abd-835c-686ba089d19a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.15.52.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14b4de79-afe2-48b0-abc0-2c74cea886e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98466405-3c4e-44ae-8aad-dbb83d46fcee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.107.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf136638-32a1-44a3-a732-844f909cc3b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.164.201.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab006e0-13a4-4558-9904-7e2f466e009c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.48.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec29e4a9-b742-4187-8523-e6ff9d585130", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.180.49.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff543ba8-35b4-4ec1-ba04-29ff6d829da0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06967d1f-e78a-4334-b71d-25f617419d62", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46743dd2-fe08-42fe-8eb3-d7530b6894f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76366620-7954-4600-9f69-c281352264fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2cec5b2-fe87-488c-a1b3-9a4508e246f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1cfadea-3342-46fd-aba9-be79e48c90fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adb3f678-08d9-45b0-861e-621c11f4b794", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--010da0e3-d48b-4cd1-9838-b6e24f3424a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.187.178.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68e7c814-d6be-4a27-9f87-08699ae70775", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.242.97.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ae48a10-9270-4601-97dd-6371fca1851d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.42.205.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--014d8350-e963-4d77-b040-61f0b5896819", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.59.206.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f51b8ae6-3653-4e29-b837-4da06707981e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.68.225.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17e0c2ce-336c-4fd5-8c4f-84054dbe2b6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.123.210.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--955b9491-1b8c-4259-b1b0-7e56eead34f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.130.202.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bd5a472-bdc1-4367-850e-faf495cf3556", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.154.176.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8535e8d0-fd40-468f-be37-389bab8a342c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.158.16.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bbebd4b-8f58-40a4-a2c9-a4626d8fa0f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.175.83.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b875ada-3370-4026-a44c-6d139b16805e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74ee1ff5-cbca-4b8f-9d31-118a81d68651", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0daed7-ebd4-4b29-a02c-4ac966ec952b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dd8eaad-2b26-42f1-a867-329186518f6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7efc4eb-7bf6-4496-97f2-0a7b6c3fe9fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799edf6b-d944-4861-baaf-1c03da6fa8da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3678529c-4acf-4046-b2ad-54827166abba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59005ab6-c094-4d1b-9507-623753035258", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5787ac62-591b-4d1e-999e-5d7a99c1979b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.191.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05a5638c-c10c-418f-bf8c-7ff9ddcab44b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38bf1d8b-b016-4699-9951-f9f9f783e940", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a105b69-c410-4ec1-905a-acd36aa7ee57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11229e59-1128-4897-a58c-b89afdc05e15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9bcd55b-7132-405e-a104-8de9601450fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080186d9-56fe-4ea2-8fe2-5b0cbe8d0906", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df31ede7-619e-4c08-bfb2-78a9280013fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbab3c6c-9cdd-483b-9087-fb24a2807dee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8074681a-bfc9-4811-b5a3-3f00bdd0973a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c120c216-8b71-4bc5-933d-65bfbcd75596", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09291d2e-7025-452b-a804-f08db591d11a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82e44a7b-cfad-4cbd-82b3-a281f8732f23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c8e9fa8-5abe-467d-a14a-17afe1d93966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9c260a9-34bc-42ab-ab4f-9a34275f72fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35daa9bf-54eb-4c1e-a3d2-ad5baf6b06cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eaf8710-4989-44cd-8a0b-43d8f47bfd27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c95ec1-0794-4ad3-b424-5335a00c8ca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5897af15-d9d6-49be-a56a-2142048d5ba8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c0aa248-3e73-4567-9f1a-a0b9a50f92ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcbaa49b-30d2-483c-acb2-bf63e693203d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d2b2c46-7d85-4a30-92a0-9df9cbabe060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b613dd2-bebb-4ae4-b033-f76685bd4a4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf41cdc4-ebed-4588-989d-c03659bad52b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3382e0-d285-46c9-9072-5908f4e6527d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7389b7-af96-48dc-9bae-f700216f066c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32d2cda0-ed46-434b-bca1-d71fce065c0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5389363e-55a2-430c-af33-0e8fd16f3ab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7f2f903-050a-4360-931f-aa5026e86cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23eef671-2b4b-43ba-bd7c-20481a82e6ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68d6a54e-3d30-4db0-bc95-a7caf16579eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb179ba-9f4c-45fd-9e97-e79559681c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5115f906-cb1c-4025-99b9-6f72d54dc96e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--333dfd72-fdc5-4971-874b-0453b6555b96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639e9f44-7d5b-4d1a-9eb0-f012987004d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b7cd361-c12e-495e-85fe-84716e2fbd87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86c0bd1-8878-4d38-a749-2f8366c5ea45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa64b457-6c91-4b5a-a5f2-844904b6abfc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--347eff51-599b-43e9-b1e7-0fc661151e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a76e855b-ad28-4b9b-a4c1-12bb42115f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae20cc1-fa95-4aae-86ce-95b6f5ea4226", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3b990e-bef2-4a2a-9a2a-14d10c18410a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c3a9a3-3d15-4abe-b501-afea008d39fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa54166f-035e-40fb-aff8-65423840b652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e813f48f-818d-4cb6-b22d-ec40aeb37e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e1e8211-cf14-4276-bfa8-12c67c4a92f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb70033-b1b8-406c-b42a-bf0e5f532f39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040d2a41-767f-4ad8-94fc-cc9091d47560", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b591896c-3dd7-48bc-932b-ad28640eb941", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4335b8a1-d84d-4a09-9333-6dbd942402d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71680750-b1a5-4b01-b311-296b2438bc9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74a5821-9a85-49d6-a3ca-f37a99a2f70f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c011882e-62d0-434e-9400-bfc88a5a45ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7a03557-980a-4c5f-a6c9-471458051407", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c39a2cb6-ffa4-409a-9976-8c012a97b5b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b65e290f-2137-4021-86db-4e06cf164b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63c8fe9d-37cb-4b1e-b849-545fa35cd4c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19c75a5e-a355-4c7d-a2ad-15de7b81ac9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de2d690-4474-4c57-a7c6-fd3205d6c472", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791b8c99-1681-404c-9986-650bad3c6714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--852813ce-7dde-4a9a-9e99-5691a3e83551", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb561c6a-c915-4f5b-af6c-ab21f427821b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cfa9c4-6581-4301-a0d8-adcc29454903", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a89460-c42a-4783-9ffe-31f13d993e4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75cf463b-86fa-4c94-9baa-90b102aedec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98797b78-ca9a-4d5c-b519-2cdc21e24956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.184.76.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--749049a4-9a3e-4bf8-99e2-a067d8f2d8ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57dacc47-0196-41a1-9ce4-ec069b33c480", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5bd5e04-0379-4b87-ab21-7636b9bbbdb5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00b98f8b-224c-423b-9edf-bcac53e519b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a432efc4-8878-45ff-8935-a66b7d048868", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0eb1645-672b-41e0-86ba-6936c17231b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.230.103.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23cdcddf-ebc3-4020-b64e-63dc68a0bf24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.250.79.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b59685c4-d9e8-4df4-b298-6901b6cbb051", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.3.220.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a59c5607-6b00-4797-88d8-dd34e48d4e1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.139.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--500e0ca2-fd59-4a5c-bd93-e2433d81d002", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.96.139.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb291ce-0527-404c-bb72-c0fac8c81853", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.115.35.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a570be-4d15-4c66-b70a-c2f77909b271", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.188.93.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97cfd7b8-7963-460d-8978-93c12963300f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.189.155.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77955a93-0898-417e-acff-f60cbcba25c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.47.175.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60c9c471-4a73-4290-9e69-b1ec0d86f456", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.140.11.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0fdb242-049c-46bd-887b-ff60b19583bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.146.11.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb89a082-57df-466e-9556-9a624eb99b52", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.104.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ccf8ae5-9aad-4f0b-b12f-14e1e7a08ff0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.207.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cffdf215-25b5-4bda-bb31-2974da74ab35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.248.34.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ee6bd8-616f-445a-9664-fa55db41ab76", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.5.145.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b54fd5fc-3a34-47a7-916e-48c325b94abe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.12.73.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c3aa416-cefc-4d05-9456-1153b1b1679d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.177.125.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1deba8a-1e5a-49c8-a947-6b2001091a29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.199.77.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdffbbe3-dacd-44e1-9c3b-2c95804abd9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.211.108.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e89fa90f-77e5-47bb-8626-ccdb31d67228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.23.200.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1eb27bd-57aa-4989-be8b-08d75781c5ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aaab4b25-6ebd-4a7b-b8ed-4f3aa43d2074", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caca74e6-61e8-4a37-a70c-c0fe46c4d4a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3e637d7-bc14-45ba-8bdc-69eab94b2462", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--063ea47d-5e97-433c-99a2-fefc10b1440d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a77710-8e30-4093-baa2-5e79a1539c68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6505ceeb-039f-47df-aeff-cea026e5b88b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe069878-0661-43e4-a766-095d36f47037", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3faed274-48ae-461e-b724-41aacb65b668", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de681699-2926-4a74-bb12-03d7785f08cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a5a307c-2f8a-48e4-84cd-cf8464b8721b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23606eb9-a4f2-4062-ad3d-8da481d81fc3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1556d34-4467-4e7f-b3ff-baa7da9668e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e057d225-233c-49c7-9990-f3863a32fec1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947622fa-5927-418d-955d-b4302e8bbd33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4f2bb2d-a0a1-42ee-bbed-82bc45519b17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--681f63d5-09d6-445e-b44e-2065f829b5a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0b00ddb-df95-4814-be8b-7004695b6656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da595531-64de-4d44-962f-cd53f9fd898c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa03e30-a6af-400b-9cad-94a18b9d6e98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1642bfb-f782-48b5-8671-986bc7277c94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7016edc-3e79-4569-9e24-5cb883f630b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c97829-f129-416d-9aee-28bcf747bcb6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75812ba3-0d68-4a34-a122-30e28499bff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcc3bb90-f3e7-4167-8bc1-04508b0b710f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f846f39f-5662-46ec-b8f3-940e8683d9fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acda3f3d-01b2-494c-8f5c-728541cfd15d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d18c4ef-0f33-4f50-83ff-d21ab7c018a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbeda1c2-e646-4e09-a0f8-029fe35fcd63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf46a694-4c91-4efc-9599-0344d1061394", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09c74626-7a9b-4b12-af7a-e7b46520ab0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--589f2586-c89d-4b02-a092-16adae12642d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33d62824-1c7a-45ec-91e5-69b5cab5558b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b11d3fae-de67-4a4a-b246-35a57ed63269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7caafa8-95ba-475d-8ef3-9d8813e5614d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb69824d-b154-419b-aa65-fbeb0689a050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49626b04-6a8f-4bad-8d83-f3dafe17f7b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf904f72-1ebd-4f54-bd76-0ee6ad15bbf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdbbf40b-2d76-4142-9716-ebdafd18a36d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4fd540f-83d5-45b4-aba2-472b27f22aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80794109-b0f0-4dd5-bb03-e4a774fb06f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4ad4ce-0c33-4122-8bde-bd629ce3bfd8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af264fbf-faad-4936-ba0c-e464fc2bbb01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba32967-2b50-4ab1-ac52-57eb77a918ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d577f455-01d7-4753-b7c9-ed4dc4c0df73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354697cd-aeb1-4f55-8eac-8139edec39a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc86e9d-20e9-4b7e-859a-c1dc01a42e17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616e6dcd-3f08-42a8-a55d-f6c7e7eb6fca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b80c5a93-c9c7-4043-989f-d40b7906b50b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17043c9f-7ec8-4f03-aca7-841fab6bffaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c6e7d43-b006-412e-a485-a89f134baab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4143fa5d-a330-4472-ba72-dd28e0578dde", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9c211f9-6d68-49c0-be10-059163dfab6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8292322b-460d-460c-aa68-1e6afb530504", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--294fab36-9674-4c10-953e-4444d907030b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d9e4b7b-11ff-437b-b50b-2655f3eba391", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a32a78b1-22da-42d1-b7fd-c75a4031743d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44a1049-2335-4f15-859a-3c7b484817e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb224e23-8cfc-446c-a9ed-499f93bc783f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1498f2e-11d3-4961-8a57-78a74a7f2e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17cf6e86-ba21-43a4-a7f7-3fcfcd09c058", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a48d922-4617-486d-857a-5b19994b67e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb62890-d26f-4029-8944-30aea546ef45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58d44723-3ad0-4ca4-9fbc-5292c159321d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a2e3cd6-319a-41ef-806d-7b5e7b79cb11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65449c85-a557-4b11-95e4-e67915e82252", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de00b4b1-f47b-4788-a7ac-2c829611fc6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4d14203-5cd6-4ab1-bb7d-285388d2a05c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2bec189-31c7-475e-8303-7a8a1c058c2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8168a3ab-4a36-4a41-97af-cdd97af175e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44e7f071-d049-49fa-bb5f-5d966b2b970c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39cc9687-3737-4d6d-801e-32135761facc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c90b0a-f8d9-48e3-a179-03ac0e4b471a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c904b7b-55e0-480b-81a9-77aed3269690", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d6a94b4-193d-4858-8691-2d1a2bf98d52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfc0ad69-22e1-4db7-9fa1-bc996422efee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65b83e9a-6406-4ddc-8d03-b7d1cea3c5da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a9e8f93-c72e-47f2-ad3f-ca5f324e92d1", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c94aba87-2d16-439d-987c-73f30f3c4572", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9db45a-3d16-4283-83f2-e68c48e9a42c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575c4d01-77d8-4d13-8ad0-2cbb60e7a005", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4bbda38-2219-4c30-be7b-62f9fbff1e28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba1c8243-68f0-42d9-a8b2-49c7eeaed474", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e71dbf2-3d26-4a42-b023-5e23fb990b99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9f6541f-37e1-444b-bc21-0cf37e248879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d039d28-5019-415f-8bac-5f22e85d6667", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1496467-6e71-468d-b5a3-3fd07660ddbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f66ee9f2-bf23-442f-b848-ca9ce8575c66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e7142fd-f52c-4c41-8483-56a35df4aca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec56e9f9-d064-483a-8355-26e99e8276e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95aef1de-655e-45e6-a1f4-70b1a52d6212", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ed1f17-886e-4175-85e5-adde343586ba", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.251.68.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbbcafe9-7e6c-43ea-bce8-8e8f45eb040f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.38.85.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7614a05a-ace0-4e0f-817c-c7c9f579ae05", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.134.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ff7b0c6-5680-4ece-aaf3-8634d2bf90e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.46.199.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2908524-3cae-4f87-8b52-113a1d9e7f84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.50.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d80673-247a-45ea-8b00-47e1a22d43fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.56.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebfcd9b9-9dbf-419e-bc83-ef45ea1d8a06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.56.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84bb03e7-7710-41a9-8909-41b6b0c32e0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.74.58.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c1e10a6-a48b-4b53-a33e-9716106a5c98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.30.231.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f602920-cdcd-435c-acd0-7ca5c5d27ec2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b9477b9-ccef-4077-8b12-b94eebda39d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732a6380-0623-4a16-b561-691ee50ceff9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5f8bd1-bbe7-40d1-b980-466578dc77bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d8e3bd2-a49f-41d9-89c4-8cccb53eee49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fdc1490-faff-4c5b-a930-b3d886d821e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba7f93eb-fec6-4aa6-8974-2e2f6222a077", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecde5795-ae05-4afd-aebe-b095f9b53ff4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71c6980d-9a00-4349-a7c0-7d2eb23e6d76", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af6b44c8-0304-4ac9-8f80-ad564e9d049f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3bf1fd3-e7c4-437c-8b31-4501744844fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--463f787b-ba31-4d54-96b7-83542e342160", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d93ec9-4692-4117-85d8-7f98413857d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8744721b-8e65-4df2-b099-42506dde1a87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2884c984-b7b9-4bbf-a2de-463321ca8006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27422970-fb4e-4c68-8922-26b9341cdd84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e20be5ca-89fb-46e2-b986-2095286a41b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.154.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06ca0532-e109-42cf-babb-b4ce4e94cbcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad1b60eb-54e5-481f-b941-4cc7c61dc554", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece11f31-e0eb-424a-813b-527b4d98a985", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23086fce-8d9a-4852-806c-3c48a377293a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6579ab2d-2be2-4e94-b613-227f4fc802af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc15e20a-7d58-427d-803f-28f235c69e97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52d73792-70c7-41f7-bc56-280ceaab444f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.45.155.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a702cf3-8bf9-45f0-8afb-4831d28a31c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.219.202.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--094b9ae7-e42d-4a4c-8feb-e9e2e0d3d2f6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35815a0d-d7d0-43e5-bdd1-9cfc3c4528b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5b5e627-479f-4731-865e-da17f002812f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baad1aa8-4da3-4e9a-83c9-fa2fc8fa84a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.63.211.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e351e5d0-71e0-40f5-87fb-a4cf09832a19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.100.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b26b1fee-89ba-42d2-a3ea-0a08cea019b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.117.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4256146-3567-4f3e-bd61-6726dbf01f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.40.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9b8cbc5-5cd9-48be-b154-512d58cdb72e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.102.97.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8f89a5-09be-4f52-9762-b3eb4f901929", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.17.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e9bcfbb-e1e3-40f8-ba28-1a782ac0a040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.33.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f372fa7-0fce-40c6-96da-7e6b6e6b31b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.115.90.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dd6896c-4d21-45c2-ac9e-cd6acf5ff4e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.217.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7162527e-8828-469c-a10e-6dea814acce6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.217.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f80e7145-08a9-45e2-b94e-0f1fedeb90d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.233.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e73da31-a3f4-4099-94e7-8c672935eb0c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.240.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3730d50-b309-4455-82d6-1fceeb829f7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.118.32.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71aaff62-f748-4b8c-b414-971d8d1dee44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.119.86.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--449eadab-7d63-4eee-b2f3-921a9c8d0255", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d620ed54-91ae-47d9-8a2e-c3fad806f117", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.12.240.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a1ef33a-7e8b-42b3-9ce8-993c0d271946", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.124.91.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03c0fa17-27c7-4f2c-8ba5-289c552f8d5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.202.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c28c956-9aad-414e-b721-f42c52dd23f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.202.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11d945f4-afeb-4f32-b9e7-ba8b5005186c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.127.244.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd38e0f0-20d4-480a-9834-0abe50120c71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.73.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27b14763-540b-48dc-8575-94a0dc68670a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.75.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98d40017-0718-4d10-8692-df42d896a102", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.75.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a453170-98d2-4aca-a8b4-5b08c09c5a5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.78.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b51598f2-2595-40f1-a7ec-171b3d076e96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.80.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8650972-935e-4cb1-bc57-cf95c7ab8e2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.14.94.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d6b7f0-1e26-48c5-8c3e-ed8a2a2f499c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.163.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb5dc126-aadd-4eb0-9007-18269d7cfa92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.163.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8056cf-f11d-4945-a2a2-55f76f1df9c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b50853d-5fe1-45b0-8c67-c69a659bc1a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.224.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9592ae1-4164-4548-8f20-53b154a15cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.15.225.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfe697df-66cc-4cba-bb8a-a91f4c534da0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.150.193.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f2c985-1d1e-45ae-988b-c6912ed7dcb6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.151.214.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b4164dd-c488-458b-98e8-fd4d34078912", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d84b5c1-fa5d-4fa7-bdbe-e72fc834bca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8585ad0-8164-4660-9266-fd10ff6af02a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a030a0f1-64a9-4df2-a18b-10e4e05d0660", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e012afc7-193c-4567-920d-e376e96e5b31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be03108-ff47-4e9b-817c-7e18c846847e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--652083f9-dac8-4af6-8030-ade2a716884d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df3e7d8-c580-410b-bb2c-a7713d6b698e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.15.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--154ca367-88c8-436e-9c1d-b2ae194a9041", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.34.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ffdb528-0cce-433e-82aa-85c711f6f7ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.60.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1a3226-48c5-4e29-ba6d-134ffe21a3aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.163.74.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e499bd2c-0434-4796-9a79-15003f943e21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a08f8925-ffa3-4402-8683-369ee3d4e8a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25293030-4a16-472a-aa35-3c22a5127e5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.0.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92ae9d98-afd4-4a92-bb24-db9ab531619f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.11.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc716c75-f37f-44c9-b9e9-f86b8d7b063e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237a3346-a17a-4c0a-af69-f1221a18e027", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8ee2e5f-213f-494b-b547-877d5120ae96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.120.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--150ff082-8feb-4bba-8ba8-cfe2ac0b081c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663e2daa-51f8-4d69-afdd-8b21d6cab6da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0ad2f78-7842-44ce-a93d-a00456a51a17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540bf710-86ab-4223-8d32-1b0955edb0f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7017d33-1b59-4e16-abde-902d5fa2d29e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.121.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54c0bf54-df96-4f07-8966-8058291383c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce1c9c3-5d5c-4461-9002-7a43f12dee14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b40d8931-1133-419e-b9c4-cec9d240f975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.122.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ebe587c-5086-4caa-a0f2-7e90baa04245", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.124.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ca2907-13d8-449b-a7c5-ba2b13de8c7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceb0d4b1-7f24-4559-8d44-7223332c835c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.127.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a978eb-07bb-4f3e-ab94-395feeaadb74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.5.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a46d5266-63f5-4841-822c-5c0739d7d2b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--870197ac-8972-4d68-9aef-95b7ef5b4006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.168.7.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b43bd5-4354-4de8-9f27-bc068c645141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffaf0c6e-b282-4875-8e3f-6e95b50bdfea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86ad6d40-58a4-4d16-961c-17e704f38f14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6077d32e-fe47-4e0a-8504-a2ff92157105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.105.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--880f6761-c0ec-4def-80b9-3fbb44a0d19f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a6b0b5-f829-4e45-9c1e-d1599fc77501", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79eac7a1-ba52-4a0a-b084-37cf48f345d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.106.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e951a390-01b8-4edd-896b-df2da9deb399", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88d0b1aa-c1df-4aca-9602-5fec4275f96e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba4552a4-6d63-4421-8faf-27dfd95d3841", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.107.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5e6f7e-183b-4239-a443-7325073435b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.48.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88783a85-6ccd-4ff3-beb4-f52c1e3e361a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.81.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b48554d-f522-454f-9cee-a79a0ff43b7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.83.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbc20256-9f3d-46e7-b6e2-65134c631163", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.85.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f405a0-326f-4ec7-a79c-7b485bd84461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.169.85.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d356f3b8-2da3-4a13-ae4d-9f0b2f138dcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.32.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e383c3e7-b8da-4c8c-8eef-6a8ddc1c768e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18961c88-dd47-446d-8c4c-d2590c0702ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.8.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--083bb99d-f958-48b7-9d30-ff0a1d9a7e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.9.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e01fb5-755a-4adc-9afc-2d1fd71688d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.192.3.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc7756f8-9202-42ca-8641-d68513c42ef7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.203.42.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64dd5c84-7c91-4893-bfa7-94ec789990d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.220.34.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c97809-a320-4484-b1d4-8a1850ae6d5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.58.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04b33f67-b4fe-484c-93d5-66d90992da38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.58.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b468ec6b-3609-4abd-9ea9-eb7c7ca9455f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.66.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c053427c-36f2-4560-af8d-65424568d5e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.221.72.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0900ded3-c692-48cf-aa30-78c13e68edda", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.226.124.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b2d4ce9-19ae-4ef5-b996-c8981e49b6de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.226.61.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd7f15b-b1df-4287-875d-b3e765c76b4c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.243.208.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aa45ea9-1302-471f-9d0a-19a098b11686", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.255.61.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de15b6bf-d96d-44bd-bb96-e323655531aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.21.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac67d4e2-947e-43bc-8e1f-898150127b90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fbf6fda-f346-48b7-a307-26500fe28552", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.29.23.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0100705a-a4ea-46b1-bff2-6740491dfbcd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.3.166.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e6e57b8-d523-4567-abf1-634e1790685f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.32.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c0fcf0-9f27-452e-9c65-ec5cd395df93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.37.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9e2fb33-8bb0-43f1-be15-66d9fd9bdf21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.38.42.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e8b5b44-b0fe-471c-982e-e08c07139260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.40.250.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1052c418-80df-4288-b9b3-8c6df41a4d82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.84.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5c25af-cf10-4eaf-822c-b812c722dfc6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.42.92.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe62d42-1418-4356-9b26-a22800e8403a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.226.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--351e2775-b9cf-4d15-870a-1c48674fd459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.46.232.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce360819-04c6-4e92-b023-f4841ed6d96a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.51.241.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3235a43-62ab-4355-ab2c-585db0eb603f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.51.244.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8667fe-2e3d-46c4-ab4b-d32dec6350ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.24.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d80b085-8f08-41f2-acd8-eb3daf9db626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.35.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06dfb58e-7114-47a0-87a5-459c8cbb4e7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.55.35.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41773e79-8e82-44cc-b5fe-96bb145463e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de0bf2a2-6750-4ef1-b392-94ac965acd95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5776e76-834c-4017-b125-c8b5874e6b17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7da6bbb2-117c-4645-94d7-b4b5163674b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a59866e-4dee-4e4c-84ba-d1d9dca7c857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--930d936e-6c28-45c1-83e4-53259ec427f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.104.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac14a3fe-d3de-4d49-a8d8-ce01059eb3ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceb153bd-80a0-473f-a7c5-bf1b50e24dd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91dfc715-062b-4c14-889d-f98ebb1cdb20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3c756ee-62c7-4181-8d7d-f057a55b4744", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0597a6fc-3044-4be0-9098-2a1f5dc4a34d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d1e053-b770-4b5f-98b9-628fe23a2b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64554e61-ff03-474b-9613-0d26f113287c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.105.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75fa72c6-488b-42c5-9c77-09db3160acf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04259bb9-9416-4305-8cc8-44f598c11ab0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5ea199b-c21d-4b5b-a98c-c821ee2d2022", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.64.106.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e2aed3e-de1c-4d82-b2d1-9e94c28991b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eddce51-26c0-4fc4-bdd2-0f9bc6747a82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c52196-2329-403e-af4a-ca581d234166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.154.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--badb0e06-0295-4b1b-9105-b551cef8aad9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d981b6f8-5f80-4fc2-938d-9c87dd0bd800", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4cb1d7d-198b-4f4f-abe6-edc61fa4fda1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.192.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79d51e8-0e4d-4ae8-91a9-b1add5c19dad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--966e59b5-3e59-4ad9-93a5-31d11b90bd9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc08c62-8ba8-4c6f-98a8-efbbf574991e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617f5bb2-5f36-4e8d-a44b-3aecede18366", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c19d8ab7-30cc-4d17-8f9e-3577b0805df0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddbd7648-60bb-4200-86df-60e864deaaf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d57b3c-6ea0-4d70-95e9-1dd1948f8542", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.193.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb1d5a6-f13c-4858-9a69-593d773467fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e720ff3-a319-4b24-ab01-82c3dc826eb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7af1d56-b74b-4e4d-9e14-1c1c65c2790a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c667ac8-40e5-45db-90a7-8e06e3f8448b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77de0601-6be0-49dd-99ab-cbbaf6475e90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec86327e-83d0-4e0b-bda5-d9bab7128665", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd912743-6b77-406c-9fa6-d213ba0b0255", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56c10df-b33f-4064-b8a6-dd9dcfa33290", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.194.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237ee9a8-7b7b-4c27-9f9d-1f32ec457593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea2127e-968a-4dce-b526-271b62aa51e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34670e31-c629-4baa-921c-19d8de703acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df41161b-7515-4e71-9f15-cb115b5dcf50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71351c83-3a61-4f71-b28a-2f6714e1e73e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--223f8cf6-d75c-450f-9b60-a5d1b81d8a75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a36ab0f6-5c40-4668-8572-96f2411e6451", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.195.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f76f9a5-6a86-4c6b-b6a5-8f9f0bdb61b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.65.219.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5245ae9-4ef7-4615-9af0-0413d8f65cd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.70.200.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e43c28a5-3d54-4002-b651-cacfbb971842", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.105.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eccb9cb8-61e6-48ad-a2ab-72b7969447ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.80.88.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6925427-8064-4f5b-a4d7-bad2d8b838cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.46.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd0da2cd-fd00-4a76-a4e8-c0395669317d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40826c5e-c5c2-4c9a-a763-7c3b891d6a0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.81.47.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666e5648-a384-4c81-93d9-54566fe2e588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.83.27.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e95d6ea5-d5dd-44e9-a3c2-db2abad9138f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.144.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6be7bab2-c640-4adf-9828-37288cb16fbf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.145.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c58b19f5-48c6-4917-9fe5-6071d7d1df00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.152.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be26cda1-4027-4b4d-b5a5-9ddf6f984087", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.84.61.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d531cb6a-8ae2-488c-bb1e-bd6df5f00d82", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.9.9.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0866edb-0fc9-4834-8b02-5c5eb0d7a21b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.128.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ff57ad3-de5d-442b-8493-198144d7f327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.128.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b364d36-ad50-4ac1-b8db-d2d99a91073a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.98.164.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2bc302d-2c63-467d-ad8f-65440d45f3d6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.155.66.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--606d81d8-a5d5-446d-8f1c-dd9873be2aa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.225.60.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e3edc78-ce68-4ad5-a9c9-f57934c05bb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.26.188.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe53f201-6633-48cd-860a-3449bc36a5e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.39.60.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ade7a7c-d22d-4582-9d9e-b4b6e70517a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.95.200.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b928a428-02d8-41cb-9cd2-b6ef357838fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.97.156.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71fb9b8c-0f2a-4347-b9f1-2dc791d7e56e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.121.83.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3f7fd5b-9faa-4611-8463-1d88978afcd0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.138.167.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50cf1665-fce6-436a-a8c9-3717993c2a53", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.138.224.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--231ceb9b-1733-4ad5-9393-1025dbd7fb9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.140.123.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4094eed4-4602-4c58-bdbf-f518ecb05d00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.224.88.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40c1d098-c082-4fa1-9709-205839c75bfb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.249.192.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68ab105f-5d9a-4aa7-b835-286c1d55b7d7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.77.172.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa29200b-9dbd-4ccd-ade1-8be2cea3dbfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9397637-a2c6-47f6-8681-054653b6f2f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.112.47.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c786903-4acc-4a24-bb7f-2c573e64be2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.147.204.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d92337ce-b637-4844-b151-95de10df6b6d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.165.22.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5623dcf0-f102-4376-a385-d11d075a69eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.183.141.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75e65c43-d16a-4cf5-a205-ff821cf8bc10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.28.82.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--034332f4-4f30-4de7-b0c8-019458352228", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.51.70.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1255f13a-243b-4cd3-8c1e-6d6d6b466fb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.71.141.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df32fa4e-1014-45da-a784-f27d6e33d416", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.88.222.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec1d6e11-7fdd-4615-8b69-3cf477340e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.88.244.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e952fa7-44fb-4066-9ba1-bbf214f14405", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.161.39.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0229aed7-b594-44e0-b026-c3ae403e8376", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.161.39.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba909efd-4896-425d-b27b-1409a8bb66ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.25.223.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe10a6ff-8d43-48f4-9d38-f29be5eb8905", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.55.131.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab34476b-784b-4bcf-953c-1e1fc2422963", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.74.125.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7d98e7-abfc-43a1-98d0-b1569d728609", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '204.76.203.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--888a3c1a-72e9-4d15-8e31-deca0147b37c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.164.156.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f386f8ea-503c-4ca2-b486-1e3903d8d1dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.127.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--836c7dfc-d585-469f-a12b-c0aff6254343", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efc6fe93-d601-45b0-bec7-ea9eae92a8be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--424c9c2e-846e-46f4-8fd6-7ec32dc8d638", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--401df100-7776-46b0-8d69-63e47bb54036", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae92291-ceff-49e2-ae46-1707f43981be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f8ca3dd-06b2-45e8-8d8d-f5eadf0c33ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dbd62c4-2637-4d79-9af0-7da2e6cdfd17", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db40b8e3-cd2a-4c1c-9c6a-db5b35b63a9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a1db5a-97ba-4d45-8d96-23b16d5c5af8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71e6189f-8d51-4031-bff2-898422d24fa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66036ecf-1c8c-4a48-830f-60b57052ff5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089bc2d7-6edf-4b3f-9d28-6be49adf7dcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55930089-7922-4d5c-bdae-db278a1e0199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--972c68ef-05b6-4118-ba19-f0c4df5fad1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7172e9ec-1563-4fa3-b9be-d82c1ed91b2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb27f519-6828-4fd4-bce5-abda7537d1a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75daabeb-5fb0-40d5-b01a-d961ace43430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91638980-20d0-4cde-b706-aab85e9ae025", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412a3454-25f9-4df2-ba00-fba054b15edb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc72542-5613-46cf-9454-310e43020bcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f72db29-8479-47e7-a9a2-c76c6ec9a4b6", "name": "Malicious Host", "description": "Observed: OPENCLAW, PORTSCAN activity. Sensors: openclawglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "sensor:vultrmelbournetest", "protocol:openclaw", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2cbf171-2201-46e6-bc76-e3192355a98b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e870b9e-b19d-4f49-99ae-f5f2a8ebd065", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2b9a12e-3247-4e9b-b52a-5e99f320e401", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cf3c82b-87a6-439f-bd44-521268adf9f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b3f5ee5-06d7-49d2-b97e-111665074573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f8af2f-3661-4bec-9ee3-27d3f41cf9ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--565a5456-e4f5-4b98-ac26-54b9410638f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f2600b-c468-4582-b316-37b5a7c3e1bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b825999e-ee8b-4176-9250-b3084fbcee97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2debb39c-2c50-4d1d-b01f-ea966f103d15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7491923b-e00b-48f2-a30e-fcc91d9e87b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7f6811b-d897-4899-b88c-dabebab25dd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3155e30f-524f-4499-a520-286644357cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b900e6a7-342b-4950-83a8-5306da407180", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5fbcc8b-1446-437f-aebe-0bf7896800fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4a41655-7105-425e-a92a-1a03dbdbcf12", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d07cb4ea-220c-48e4-8560-f3d947134716", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--957402cf-5776-46ad-99e5-8a733c12d6a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2ec760e-9d38-4f16-a8da-f58e6418e2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42f4cccb-33ba-442a-93ad-3602302fcb26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85c4ce83-e39b-438f-84bd-172a2acb805d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f42b7f-9003-41fc-ab8a-0a0a185f9cea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ac67bb6-a386-4efd-8551-fa7783fd62fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157d7aaa-04ae-4780-9413-6536f882bebd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288cbdb3-dbd0-450c-83e3-8ac593f04cdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aa4207b-d7dd-4ced-9054-121c4b47284f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aad9438-2742-462e-89d1-68808123e0ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65372a57-35a8-499e-a1e2-69b6d4009fd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--420b71ab-2598-4bc4-8c1e-72ae7bf56a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7fdf50c-1db9-4797-a748-11c2c6972c27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b59abea-ce8f-40f9-b73b-8fc380fc3589", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ab3449c-104c-4e2b-be97-782004069a8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a3edfb-f63a-4cd5-a807-e6016d3c61f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--645189bf-c5f9-4f99-b694-f90f4813bc36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79174605-c5fe-4a27-beca-7932d5d54ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddcba2df-c8f0-4f11-80bb-4ce2a7c7d353", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fd46de6-7679-49bf-a20f-f6b2c72a9e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ec6bf35-004b-49a7-b5c0-71330ad622e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5df23c-2d4e-452e-95bc-d50acd339a98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7701b805-5aec-4498-8619-1b091c125b87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf400f47-62e9-4e3d-ab0d-038ea04e5348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3918a9a4-3f1b-4b52-b414-7f3c070055a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a4e7555-f42f-4a82-8a27-d2c6e7927fba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c471487-26b4-44e5-a20f-93d3cb63b9ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7b3a148-7019-4bb4-9883-89b880680c95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a10f6d5f-4e13-4027-89c2-2ef3079fedc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38538d4c-430a-4190-961c-c51c5deccd5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77d0f6df-53b1-4715-bcd5-24b2dc309040", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62f17247-289f-4b4d-9dab-4c68e0fc9beb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e45a9bdd-c65d-427e-94d4-af9f2c88a7ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956a40ea-fea5-4c27-917e-9f73570bb487", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7571d174-8264-4b53-9ce2-91f2349f191e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a90bd0e-ca2a-47c2-a7d3-0e86d6bc310a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c3a234-bf4c-4d0b-b481-266ef59abe2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8f3aa5a-4510-40ec-b963-34ea28656a07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0cd18d6-712a-4157-a947-22da2ac786eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--581fac0b-1f67-4c7c-a2eb-9156553a7b4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21f6361d-aabf-431a-8b31-83c13b66c48c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b4184f2-5036-4cfe-9450-e8c8193dc522", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54800a98-5056-41c9-a0f0-3dae9194fb95", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f3ade5-1100-40a1-9bf9-02db21582f6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bced8deb-a9eb-4a01-88fc-92961781593d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9f7b0e-0515-4b75-b000-ba8182ef81a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c24e262-50f1-44be-b6c9-0c877641c011", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d73d08f0-076f-49ff-9c0c-15226d6bf971", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db13330c-4b43-48fa-b21f-9299d7cd416c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95f6e3cb-c2cb-45df-92e7-577f4a301341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--194fb8f8-7972-4703-89c3-e03c736ef355", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7beba31-3a3b-4386-961d-927ee8cfa45a", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ebb1f42-2ea7-4468-8e37-c78b4240a9bf", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc97b335-9bc8-4b9f-a191-d15031e9a1c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c1cb63e-fd6c-4314-947f-92f63c1bf724", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.254.166.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--297bff78-5fb5-4b45-a225-b8022125f531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.169.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2973c56-0819-46c2-ac08-4899d262f22b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.207.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59ad29df-f1a6-4c32-b321-fb254b8c5281", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.58.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--882bcb40-b345-4ad7-ad2b-7a77a7044810", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.196.120.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f87221-0a04-454c-a485-2606e033e956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea2fb3af-ce16-4e54-87d0-fc7ae957ae85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.221.176.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8d4d01d-94ab-419f-a4e2-5babe89da5bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.223.228.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df9523d0-6975-4bea-850c-40cd0fcfcd15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.228.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9805f12-9c90-4e8d-adf8-a79b88afc5f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.12.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--166406ee-a40f-4b25-857d-a7cca251312d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.17.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af74dc4-020a-411c-8f18-f3a4a1520ae5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.33.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d820c62-d9f5-406c-ade0-e0163544582a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.58.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369f9ae5-bd6f-4d2a-b66d-b468985626d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.66.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe781673-dfd6-4a0c-88a5-3a4133dc576f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.78.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6d8431c-b93c-4517-bfc1-ba7d9190b3be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.86.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4f86a2-c3b0-4fa7-81b9-88eb40b68220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.90.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15cb93a3-5e60-4c24-86e4-aee80649e031", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7395d0c-fc6a-4877-878e-0e95256fdfe5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3ae8c86-ee94-4208-99de-8bd3e24128f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef0c665b-dac8-4e21-87c1-9ab73858348c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bacddf5-733d-4c80-86ce-f32591aed0eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ceb164ae-369c-4b32-8084-1df30d9d7c7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7aca16-7844-441c-8e35-35a6bc755843", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.82.113.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5d24af-dccc-4037-8212-aa136bd0ecdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.242.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa30d9bd-9a3f-4ad9-aef8-63a600d95fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b07e0fe-5df6-4109-a1bd-4cc2d088c94d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.87.243.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3fd5b8-2d0a-41fa-a7a5-c147e0f8b6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '208.94.105.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf17a6c4-db42-4964-bc1b-259d6e40f9d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.45.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c58f5c1-9ab0-4bb9-ae6c-d28c0598a85a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.141.46.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed3c7bd-cad3-4ffc-b338-83e42d0b49aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.222.101.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956779c7-68ee-4265-b6cb-f71f652ec55b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.167.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e367201-6de8-46bb-854e-834ff2d9e6da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.224.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c4bba9-ce47-443d-8663-d678117a6cac", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.6.179.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e5b5cab-ce41-442b-9c12-35114f86073b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.90.232.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86240db8-de21-4f29-99a5-a1728e49008a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.90.232.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a8d817b-c842-4c13-8162-ae8fba2abc21", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.189.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c62bbf-462e-4f93-ac68-39d98c5dd0a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.191.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09e70a22-9ef1-4723-8338-4c873aeb5f30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.206.8.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--747ef61b-b2ee-429b-a54e-06ba82485c2e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.212.49.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99dd2555-ee82-42a7-a63f-10f791b38f9f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '210.91.200.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eb2f3ae-b0a2-441f-a446-6309d904fd4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.106.133.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3622985d-e92f-4578-acb4-08a568d44161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.180.105.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f15ddf0-5f7f-4171-a798-e955d33ac40e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.211.172.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e337304e-0534-41fc-9ea0-b79dce053486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.229.200.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d702103b-e0a8-48fa-8258-025a0734634d", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.253.31.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e93e7a-96ce-4b16-a196-d465bce31b57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.53.113.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dc12053-5d74-486f-a2f2-733b960a1e80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.12.24.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4999cbd6-da64-4609-978f-75ae20fec8a1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.154.234.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5dfc63-0dfe-43dc-bb98-3af763f36f08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.192.240.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800cabb7-326c-4b15-8714-7ea954fe045c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.30.37.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53481139-dc58-4e54-b95f-fdb837535cb4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.34.132.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80af3435-7416-4e37-8756-0c1206224ca0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.71.244.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55bce1ce-ee1b-4c12-9c43-88d9d5f39df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.91.161.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--292e0345-3949-45ea-9de5-b9b36bde9dbd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.183.120.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157e9ff2-0e60-4981-bd0c-3a3fd89622a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.199.54.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1938388-cea6-4ede-8581-ce246e81423c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.207.202.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9817cd74-a6da-4a61-8ba6-edd341d8ecd3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a795bef6-d4aa-437d-be31-9ecb6f691ff6", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8d599cb-0a05-4eb3-b9aa-289a3575d594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.126.225.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff72497c-90f2-4bd6-9c67-736f6495cb39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.15.32.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea1c84db-f301-4d84-a53a-69a47957bfd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.16.128.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a120582-f53d-4164-818b-25cede1544a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ada057-4201-469d-bbe9-7a1a5c8b1e3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a79d398-b94b-4fa0-a03d-16af6a25dfa5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.180.246.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c3e770-98d3-4c21-9056-c4005e52184d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa1c308-0c0a-4cb3-a4e6-55f08b747328", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1edcb7b9-68f8-44bd-8540-c519c443e5aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbc14b83-6c08-4915-97e8-ebb9a96791e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e9c1440-8e2b-4e18-9a3c-2ef789c89f1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--086e9eb0-fcf4-4ff4-9af4-add503026803", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61dfa38-8f98-48cc-b023-d1671c823c3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8b0c238-44ef-44ce-8af7-a8849b4a0df2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35cfc276-82a3-460a-a007-f0a6f33b02c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3fe23f-4956-4e36-8027-244fa5649a22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de528465-3835-4054-9114-b7671452c281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c20c30-f852-48e0-892f-dbedf62e3ffb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78b50672-9201-44e7-b505-f8114b03f3de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1246900e-d23d-4f9c-ab68-5bcfff670701", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.218.206.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--770c9c2d-a1e9-4c03-9bbb-60d08d77ed32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--504fab1a-c093-46a7-bde2-ae17a78f3164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a3d7d03-1bed-4e8f-ae61-aeb261ae59d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.226.76.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aaa500e-9d30-4cf8-b6a3-dd9bb0606164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62219d66-35ca-4cfe-a826-249c78d505ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4037790-d55e-4007-bf42-99c58ac4f874", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b391d3-8677-4b63-af1a-3460c4ee3c8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d85419aa-a2dc-481d-abce-0ba1a58400ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dac71e3e-c5c4-4b79-a351-73730558a211", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76343ebe-d936-43c4-b29f-25ff0291ed42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33625edb-470e-432d-8975-90123e8b76f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d9a0755-c0af-460a-8349-46e87c8a4ad6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a60c4e3e-fbc6-4e8f-8dcc-a33e5a22ad69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef8977be-b333-4965-bd78-36a9450924ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ac89c2-01f5-4918-bf71-76e9900fe4fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b8907c-b9dc-4911-9c99-ce46264438fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b5a167c-47d9-41df-b66a-22c46091ee41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abfe56f4-db03-41d5-9d73-94ca0d25c9c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--553d7f54-df35-4474-a5f7-9310e4e5c64e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf6339f-04c4-42c4-b52a-0120894808dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2212811a-e62c-46ed-a47b-4b1d55bf079f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c7ee67f-40a7-440d-95be-bbed9018ebe1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2501ab7-9214-4ea0-8faa-6304f0078cf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72c900e6-42be-43df-ade2-a9ec349977bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669189b6-7d3b-4549-8c17-88b2ba0ef02e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd620b7-ce5b-4907-a7f5-afafe224aa0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f160481-cf39-4ffe-acfe-64c6a789bf5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0e2a411-cf2c-4aae-8698-225b5cd8fd17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49249f96-0903-42e2-a6ad-843264cc3db9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2cf8d48-1b09-4fde-ab9b-09d57460a9a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e339950a-c6e3-4207-8f78-fb7cd43bbf43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40a6e3ad-eaf1-49e3-b6df-8ca43a30edba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f39b53ad-f2fb-429c-abf1-1ae888b7bf78", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b109332d-0b3b-4227-8364-12484a9b5ab6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f648aa1-c960-4399-92fd-0fd55328e184", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d1b881b-88a7-4ee4-8a2a-ba62ea2c5f4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9368169a-f77b-42c7-ae65-d42e55959bbd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97c85ef8-a156-4075-8f12-3eeba09db9c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cde1b974-0fbc-4701-a293-156bbef5605d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c550c84-58d5-4d37-93e9-f117c5da4ab4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0b24516-cf02-4c08-824f-c1f1e960417c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0b5eb5-10ba-4369-8f98-27b89c5d9cee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.25.89.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--543918cf-fbd7-4216-a6a8-3801b9118cc3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.57.110.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dbd47ce-1e46-4360-95ca-cfc444956c60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9cebe7-0a2a-4788-819d-2c3a1dc006db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.113.194.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--496571a9-d560-4240-88e4-dc6e53bbfa12", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.113.194.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4231376f-3c7f-4026-b1b2-e94385086090", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.15.17.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a34a745a-11f3-486c-84c2-62a1dcbda458", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.160.226.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91dc41a5-6a35-451e-a2cc-2b0442866f03", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.165.229.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6e4a580-004f-41d7-8ccd-15fb9436c38c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.182.203.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66293ea1-c729-45ad-ab72-6fc8516d16e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.210.9.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c9f2ef9-feda-4403-a974-7f32c5710c63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.216.59.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f69faf1-bb8c-411a-8213-67101c424c8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.217.248.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--717b6910-fdbc-47fd-b04f-957e194ac263", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.151.18.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9040fa8-72ca-4167-9721-66f9b215553a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.17.184.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--831b7635-c191-425b-99d4-9cf7d116fa50", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.203.113.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36105e41-6740-4d85-a926-e1997eb3d741", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.65.4.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01741114-47c7-47a4-a04c-acc3e0b0a498", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.75.165.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126ce028-9d50-4bf6-9431-f60fcae3fda2", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.151.187.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--379c64a2-2bb6-4dde-bc93-763a518b4bb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '219.77.247.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f4912a8-8a5d-4172-8a35-a9ea205f8151", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.158.117.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee445dab-2408-42dd-8b88-27d7735c3e92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.158.232.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0760045-0fa0-4acc-affc-77a2d6a43c17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.167.232.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e03fe1-a75a-442d-9509-0c426f2be03f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.1.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bef7b55-97d8-455e-95ed-f97f62291bc4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a9ac06f-6c8b-4b58-ad8e-061acdf93c57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d767abc-c2ca-421b-b5a3-e529bacfb20d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a70484ba-3974-41a1-b072-867414dcbbf7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e701859-3771-430c-a5f5-4a424e177106", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b36cd11-0d08-4251-b980-1db6853febad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.243.133.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9687b8b6-aaff-4366-b2ab-2c87e5481a53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.246.79.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21b826a8-1b7d-4f45-b2f1-63e33488bfdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.131.2.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed8deaa1-ee0e-49e7-9724-7c6c19ff9c35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.15.22.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c26450c9-579e-483b-b289-a25656980844", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.203.38.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--980a5910-5971-4f4b-ad82-333d0ef38050", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.207.35.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057559ad-335d-4c5a-9035-2107e8e1af8b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.226.232.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d972f4a4-95e6-49a4-950f-121e146b21d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.233.24.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc5fb0dc-7eee-4dc0-bd62-69a211aacc98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.233.80.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a39f6df-6875-4702-a9d1-922991153a64", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.108.100.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fa4d925-5f95-4434-bc45-6ab11d45519a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.121.239.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9aa891a-0496-48f9-a61a-83406a791eb3", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.127.170.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11447d6c-80aa-4840-8ebd-065698bfefb7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.127.48.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd27d532-c9b9-4588-be43-0c45ea102ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.176.200.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4a772af-dc27-49a1-ad94-7738505259f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.241.167.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83d540b6-6408-4533-958f-03f3fec19a0b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.247.32.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08cf8b3e-f784-46fe-9b8a-94c3e9861918", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.97.11.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21dc9cd1-f77c-4548-aaa9-be7c9dd87319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.100.199.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6388241f-94a4-4763-a155-c3a701f3cbbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.123.38.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ef04ca-6a33-420f-8952-3f16915213c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.155.209.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d405b6b-2ed5-4bf7-9a0f-58c906090d84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.199.173.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d22f4fa-4aea-4f66-8423-2d4ed96dd553", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.221.38.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7470dd3-599a-43a7-a1fc-ec0d0981dc6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.240.94.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8373e18d-1785-4dd5-a5d8-e1aae8169acc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.29.233.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6996b3b5-7f37-4029-aec2-2d082fea0b6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.74.127.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2c21f1-b7b1-4e9b-9135-c166138973a8", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.75.193.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2634ec67-d141-44c7-b96d-a4a5c38cc85c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.150.40.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25100aaf-bfa5-40b4-8cbc-c43d3a24c4bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.239.4.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b5a2b62-0264-4158-acb2-30905b75c170", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5beb4453-f673-4dd7-8e31-9951eb44b0cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.92.27.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e75a819d-c466-4545-a4f3-aeb7eef762fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.179.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4244b673-b8b0-4b3c-9178-73b6ffb86092", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.189.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75c28897-bc97-4f05-b9dc-f367bc23120c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.92.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4d29222-1ee6-43e7-baee-8540c770d3b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.95.20.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--798e9dbf-a818-4308-8c50-543ad1cb31fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.82.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d69a2ba-998c-4d0e-96a1-31418c97ba2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.144.84.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--541ee551-c077-4bf3-9a11-0502445d7818", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2602:80d:1007::5d']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8616b543-709e-4e22-bd76-3953148ca10d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.102.134.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c79f65c-d96c-4e4d-8dba-0d7a9918897f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.133.129.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f7168af-36b2-49ee-ab22-35dac0adee84", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.185.57.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44068cae-b84e-45b9-950b-4a7c5990be5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.209.180.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c718ee-9f69-4dea-8cba-157e45cf2f83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.25.113.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--884a6e85-b927-4eb5-b128-2334a8a3fbb6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.25.5.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6662f280-da3c-4c02-9e70-93d02fb49585", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.71.28.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5437a8b1-898a-458f-8257-9cb67f9e882c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.78.70.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97248120-3950-495f-8827-a031dfbc1070", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.79.2.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4444129-130c-4382-b344-bfc6845fc5af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.125.168.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98c87c3-684e-4947-bb17-942a5f7acc4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.131.24.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f543afe4-b1f6-4de9-a233-e30e79f27778", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.133.157.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef3856b-98f0-4691-be77-205ab5f72d51", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.132.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a2b1768-1c56-400d-be66-9c2cd99053b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.142.170.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--851b6f39-a44a-469a-8cf7-fc798bc927da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.148.182.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57b82c09-a57a-4ca3-b40e-2f08c96c881e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.149.229.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce4bb4ae-aea5-4a07-a4e9-7a513e1b517c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.16.143.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--835fb0c4-3813-4678-a040-ff0ad76d7664", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.17.204.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b55ba73-7620-43a8-aa33-484ae000c142", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.74.234.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--452519e5-1081-479b-b49f-e88c8c5d0b46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.81.224.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08d7a7de-553e-4dec-9b2d-a2eccfab1a4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.82.92.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe4d72f3-252f-44de-86d9-25dbcf657ba3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.245.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dadc783b-8a6a-4282-9971-cde9820899bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.83.33.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbd26782-9af8-4ec3-8f95-1bc0df29a930", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.84.5.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86d28595-b4b6-4b3b-a1f2-d2b78dd0b600", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.85.18.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8181de87-705b-4acd-af5c-76a6dc9278e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.89.105.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a59d2ff-972c-4f97-a56c-422dc79214ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.180.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38aa4085-27cf-40dc-a224-ab751bef207b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.92.239.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6510ff29-0e25-40ab-8bf8-6551bfcd2968", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.93.248.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c7edca3-f6d5-46e0-a3b8-0f97c8effb71", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.13.213.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--718f8d6b-f912-4947-9cc8-69c99cc27466", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.155.202.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d26caf6-d213-4146-a26e-b9f93ed98766", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.220.81.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d48b9939-3e57-4a55-99df-e47b11ce726c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.176.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f225be4e-7712-4c97-85c8-df7b1b04f516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.42.184.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74fb1696-234d-46f6-b1b5-881ed8a4fc6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1122d6e3-2e78-43ba-a7c1-12fd39cb764c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.209.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f79eef4f-719e-47d1-a1b5-797928dcec33", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.233.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93f3a533-78ae-4a07-b7d9-88486b1def2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.59.118.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--202fd2ce-c82e-4979-b053-44b7cc631ff6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.10.170.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a6e4a60-8bbc-4cd8-9071-f6f2e75bb105", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.132.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--057d3161-4375-4f45-b386-a2ccba5dc7ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.178.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ad58bc5-f8de-4f52-a37d-57df27f0261a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.101.38.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140f5bb5-eeb8-44e1-8b52-9c4d4dcd6c88", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.104.138.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36bab1d3-fff4-4327-b3bd-10cabe8631b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.104.211.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c1cf91c-725f-4774-85c8-396b508c6a0e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.105.170.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2fb8069-8595-407b-8a8d-54aa27f4def8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.162.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecf52262-8317-471e-8cbf-4c298e21b917", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.225.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aa3de83-f3d3-46d1-b99a-e6af57c1a1c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.116.229.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b524fd33-7745-491d-b00f-4fca08fa281e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.118.127.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72931c71-5764-43d0-b5af-3f15b489ae1d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.118.7.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca8b97ed-848e-4bcd-a065-67439e4c9949", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.118.93.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e81916-e9d6-4a29-80ec-ae410c41ee67", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.125.0.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d1bdc3-b92a-4f21-ad89-dc28ab85a0d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.125.192.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01162d7-fa04-469b-b2c2-b1c93cb17af0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.125.220.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a77ff3b1-ef56-4367-abf3-dcb7de1493d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.125.54.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a6686b9-4a99-4ea6-989b-4402f84b5ce6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.127.111.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5ba495c-7fc8-4809-8e4d-495ec0b221b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.128.75.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11988057-f811-4bb4-935b-2a37ba6714c6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.138.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef6b753d-36c1-4368-af64-ad049ba664c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.157.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa5ac35-a5a8-4d5c-8a73-633c5d34b68e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.220.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af34acdf-8a29-4721-8b6d-46cd564c798f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.240.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01035c08-6abb-4b80-a681-846fb63b0d2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.42.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad012d0-b7c5-4e7a-a173-113225820412", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.76.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10fb375a-853b-4a04-ad75-f1a0a239e9ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.129.99.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdd31c1d-ddac-4f11-af10-a7ba567e0880", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.1.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7a85f9-518e-4d5a-97a4-6479b62de93a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.158.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0077e39-c909-4180-af42-6e6fd37fff4b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.130.17.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a94dfca-25d4-4cfe-8bd5-5b6585016dc8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.123.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5fbf71c-fa53-430c-a25e-b209ce9b212c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.19.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca8b127-a50a-4b0b-9c0d-b1d06a65070d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.131.237.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f16b573-d42e-403b-8a94-81fb022d64ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.138.6.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b19c7cd5-5cd6-49b8-a699-7796247ac0d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.139.107.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6cfdbb8-817d-4849-b199-8b01aea79fae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.139.140.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5e9a28d-b58b-4609-90f2-5c6c8b1d7b25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.139.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f12d2bcf-b33e-4024-8a81-1e20b2eb0403", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.148.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baef1795-2a51-4871-8ee7-6dd08243089f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.195.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85db0dd4-e4bd-4900-8054-1000df05bf24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.39.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f06f304c-d36b-4930-9ebe-144bde5845a3", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.126.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d548f548-3a30-48bb-82f0-590eb0100fca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.48.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5366b5c8-ec1e-4f49-9f78-498720275583", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.143.182.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81332d1f-078f-4a74-a266-1af0d4085f31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.143.208.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b7ec767-4442-4889-beac-ae2737f5c3a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.145.162.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bceb088a-ede2-461f-a06e-c695de339172", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.146.162.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f32dc29-810a-4039-affc-92661d618187", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.148.114.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c508ed98-e8e0-43b8-980e-ffcb7030da9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.150.77.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d946e8-716d-4c79-b8e5-d7cbf36ac790", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.151.141.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfbd0a99-4c81-4eb3-856c-7dd1094cc7bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.151.179.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98558bc7-d18b-4b4b-8873-b6eeb536313d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.153.128.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--831e26d1-4488-46b6-83a8-b02e8a796e1c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.123.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dedc4e96-a1df-4d24-b732-9d04214f67ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.147.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5993de0b-dd9d-4012-86e9-eda5204f3703", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.180.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7b88cb-b315-44c5-a746-e7955dc5af90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.181.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db67744-36ff-4484-82ca-616f051a7a89", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.182.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b42f45d5-5ebc-4537-9a19-011883240838", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.45.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6bc8866-0fc1-4201-9765-f481d0df7087", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.77.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05e02023-e01c-4891-9284-b9fb16911800", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.154.93.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58135573-75db-416c-8d91-659bada91d5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.158.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a52dc138-cee9-4987-8716-075324c22b13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.16.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe51532e-aa56-42df-9d6a-e1a248878a2a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.22.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53611c5-eb02-437d-9bd0-3ec1ab9cadec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.241.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b4fa0b9-ff2c-4534-bc46-d3a66dea468f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.7.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ce0db5a-5786-4165-ad86-4b8ed3e8e0db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.158.41.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6e030bd-0e80-4984-9166-5d9ede0e8d11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.159.201.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df84f09f-f4a8-48ad-8109-994d681729f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.16.160.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8260594-d2f2-410c-93e4-97e4921aef22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.162.153.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--317ca601-c289-4624-af6a-d3d4acafadc6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.162.226.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09bd3803-9056-448e-b68b-406908ec5027", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.165.81.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1011d23b-3a11-48f6-96d1-174f56b72cd0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.165.82.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a87d13-764e-4c76-93e5-14a630735d10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.224.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a33564d2-b3a9-4ae2-b363-080484e61b23", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.235.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf60ea9c-0276-4528-8afc-04e06e1e8c21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.251.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15854a0-7ca7-4f97-b5e6-2897724bcaf0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.37.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb411892-4c95-4ddd-b12d-ec27ff729862", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.42.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11a7ac10-9221-4fe3-a838-31d0136d89a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.166.93.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ddb2fd1-fbcc-4d7a-b0c8-0b8ccd3479c7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.17.118.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c073029a-8e9b-4ab6-9cb2-df228fc44b04", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.17.26.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f14bde2-08a5-45f7-9401-39f15c6dc467", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.17.85.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e3b08c0-6da6-4870-bc92-6893a5f8bc18", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.171.162.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2e42aae-3e89-4f83-b716-d6eb11d09814", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.172.226.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2050f9c-73a9-49a1-ab91-2fb908bd338c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.174.188.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d0c546-7af3-49b7-b273-facd0fbeb4a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.175.217.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8c1d6df-6b4c-45ab-8f44-0f19a1586efc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.175.40.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19fe6969-e962-4802-b210-2021d0a21cd5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.176.35.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88871a96-7d37-42a4-939e-cae958f37434", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.176.51.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64ae3ab2-0a9f-4ec7-8925-9e98e0e78820", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.176.61.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cb57131-23bf-4df1-960e-f0dfc1e829d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.176.75.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402e2ba5-6a76-4f71-a2ed-cf1f65d2a240", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.179.199.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c93d66-b161-4b50-bf22-a2441d0838ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.179.214.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb65e954-8a1a-4d49-8a81-998e4e775b4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.18.187.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a715dd61-8dc3-424e-b58b-a5b9f9a6f5c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.18.53.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0480f9-7b09-4e0f-8f7d-55dee681fcab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.180.117.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1f450d-819e-4404-9253-091f8fa0568d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.180.37.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0838f6-b4bb-4bf4-80bd-fd080018271d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.148.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fd8b07a-1d54-4b99-a2f2-3737a1ac048a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.153.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b38d46f2-921a-4f1a-95f1-747dfccb9752", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.162.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43d015d7-44bd-4093-865a-dc53fb47bda8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.181.182.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892d16b1-9f44-426f-a9ef-252c00bf3d5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.185.180.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--089c52e3-4be6-4530-afdb-51c1d4e09036", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.185.198.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf2a44a-eddb-4f19-b9a7-d3b7bbe9ceee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.197.70.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6c6bcda-a706-4868-bc0f-dce703f564af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.20.131.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8d24f00-2594-4681-8733-ce185ec0d144", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.20.164.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d81033a7-10d6-4560-b35e-59ca62b2ab2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.20.209.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec2b0ee-b585-4f04-a58c-256928703e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.203.224.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55ffee8f-0bc3-4115-b364-9c74a17ef823", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.117.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64bd035-2c07-450c-81e0-daf0d45e080a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.21.223.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a525d4b-3419-4e85-8a5e-c3d0db9113ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.212.124.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0aa0c40-f36f-48e5-a4c9-c78af935927b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.103.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450f8be2-6fb3-4c63-adbb-dab93cc024c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.109.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eda52c1-0261-463f-81c3-502d8cc9ccf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.231.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c9e185-df70-416f-a001-ebc62a0d348c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.232.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--409cc9fd-8eff-4e52-a259-4ad30b15e580", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.22.93.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46c14cb9-d604-47b1-b3d3-0bb0aa7d37dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.228.104.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b5801b-b624-4bcc-a14f-efbab9f2f158", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.205.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7373f84-6e6d-401f-9b1f-aae6c49b7adf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.230.72.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18024bc5-a849-4f9a-875d-0cd49f54cc19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.24.18.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c56cdb6-3f73-4a5d-8410-ab6824e02e64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.26.16.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd30599-c4e4-41b4-bfbc-04f6624bc413", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.29.214.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acf4cfbf-ee86-46af-b0de-e3c328837ee5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.32.134.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d83e3fa1-bed7-405b-9442-927d4e4f1de3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.32.72.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced14d14-0403-4249-963e-935a92b601d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.34.77.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41a14d2e-e235-48cf-83c3-a178491c9718", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.128.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779a9a98-7716-47fd-9929-2137e04eee94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.173.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da69ce68-47ef-4305-9170-6fac81a34ddb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.188.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea4d3721-d250-4a7c-b189-3029f0326800", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.42.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c92f2e87-859c-4483-ad5c-a93dfb81aae0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.35.72.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002b6c17-3276-4db1-8829-7e46c9a2a455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.38.15.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c923337-a1a3-431f-86b2-2d72275a5aea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.138.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bed0334-cbed-4355-bd86-8cd0d5b180ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.138.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa92beab-12a5-4316-a1c2-6fa4375795c7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.211.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7f210e-baea-43f3-b788-64bc1e913a17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.217.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65cae14b-beb5-4f1d-9ff2-222e039a5042", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.229.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced2fefb-8469-475f-b777-05756d321486", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.243.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c575a1a5-9d76-4bf8-9387-3ee9967c6b0a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.11.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2fafc4a-a62c-41ec-96f5-133fa33eaffa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.210.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9551ede8-5d52-4280-85d1-a74d9790c9da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.216.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0d4aa91-63ec-4892-b288-04d58f858548", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.241.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf83ef2-fc85-4c02-a845-cadcb4be844b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.40.251.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fcba273-906f-4bdd-8496-cc254bc5e18d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.47.106.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28f0b7b3-15a0-4787-ab8d-b7d6bbde2faa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.47.12.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39dc72c-2aa5-4345-a70f-ba3b2efd4d5d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.47.36.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab15e3fb-4ba0-4811-a710-a0f4ea2980e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.47.46.255']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32decccd-e2ba-4887-9655-31a731512bb9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.116.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e547d800-4be1-4e86-94be-9a217b3d343b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.127.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475e697c-657a-41ad-9972-ca2ae3a64583", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.163.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--576dd332-4385-4088-bdab-2b8999c32b51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.51.179.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f953eb56-17cd-4911-8394-92bf0da33617", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.165.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6db1d2e6-fb41-4e46-bc50-a5a2e7b9d3c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.197.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd58eee-9391-4785-a79e-43e4e61aeb88", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.246.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc63db85-82c0-4019-be51-4288723e5ec6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.235.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c05df294-55f9-4a5f-a562-44be52092c43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.249.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c36bd5a7-8d1d-4e70-8a7c-e1895b948f92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.53.252.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edb5d23f-855c-4e6d-9274-baedaa217aa5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.59.17.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b5d07c-3397-43fe-815a-deda40d1af6d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.59.22.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--583c416b-92b7-43c9-80ff-5df9f90b1b75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.109.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2140ee77-8fef-4e8a-8bd1-ca4f63d6d035", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.196.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e801568f-2ef1-41bb-bcd9-c0eebab0572a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.224.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dbea809-dc49-4889-99ae-bb3853e6952a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.6.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f4f9ce-b36f-40c9-a85c-7459c7efa0ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.62.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a202141a-95dc-49a9-a2a3-fad207038568", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.64.43.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1ed706-10dc-427f-ab11-fe5a8ced70ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.64.96.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8246158b-bf50-4e62-aee4-4b94a7e11974", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.69.208.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229c3f0b-423c-4a4a-9823-df0225dadd27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.7.180.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46fb85e7-f8a6-4362-8489-d9797b79daa6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.73.117.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37f4cfb1-8dcf-4709-b4cd-16f86d5d0f7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.74.52.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dfa43cb-b3e9-4be8-af87-4b646065f642", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.74.60.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--767f7009-12e6-4907-87a3-1000d1463cb3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.75.231.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b074b529-fab4-4ef9-9453-64774efd30a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.76.194.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ad9332-06c5-4e76-a95d-b64fe75282b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.217.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79a47bb8-d808-4e8b-a4b9-9c67af4153b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.219.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bc63caa-b6a9-488f-8abe-323eb410bb70", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.77.30.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c407d87-e8d1-410d-b021-17f1fa94e73f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.80.43.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d9c8e9c-9cca-4296-8b97-b96a34bec0d7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.84.191.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd5fdfb7-c594-4a10-8e33-87325d7f6685", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.135.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5dd1c90-5557-426d-9a9a-4c4baf818746", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.218.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9e9624c-b5ce-453e-b691-dd5e3d98be4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.87.71.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--912fd33e-d4f7-43e5-bbd1-05d48aad2475", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.88.110.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a85af0d3-7ddc-4b04-805d-1441317de7fa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.88.192.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79fed304-e2d7-42b9-8e47-81e4d1148ed0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.88.37.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f8cd02e-c764-429d-b89d-07b99a49974e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.88.48.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e8fdcc9-02f5-47c5-a93e-8f07cd41200c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.100.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67b799db-d4b0-4e72-8341-2c0c2464a9db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.112.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e8ee4a-a670-4bec-9e5c-63760f080877", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.182.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03930a51-31c2-4b66-8d0e-b12b55cf699e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.207.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed436e4-1891-4272-adc1-918178085126", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.250.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fc4493e-b427-4f40-9f1b-59769ef9e0a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.90.99.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e8821fb-0a6b-4902-8ea6-2f193e98c176", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.92.228.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48f24d32-67f4-48ab-a75a-3ae9d4c67edf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.92.238.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c63449e-2cb9-4b0b-b562-bd19390dc406", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.92.244.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b16d8a6-ef97-4996-838c-cd15ad245907", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.92.9.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd5b9646-8480-4fac-b3fc-15341b2e8276", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.93.94.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd2b25bc-f18f-45d0-9e91-2462705714a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.95.128.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2ae56f1-61c7-4939-b459-f39e9f2802b8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.96.208.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05ee2f52-8a6e-464d-ac5d-a0b3c848a20d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.175.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9baefb-42ef-442b-b79c-1d225cd16cb7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.196.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6606ebaf-95d7-4226-b4f7-53c54c62bfc9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.202.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b9b4fb-7d2c-4c82-802c-1161a75145c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.209.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08eab18e-3cad-4399-8f62-1d209cc1219b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.97.58.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4810512-a07d-4fc9-976c-cd2b1bf7d981", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.153.221.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a29c5df7-7095-4ff8-9480-246a3fac3e24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.169.206.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c6bdf50-b4e2-46f5-bc88-c0c232a7849d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.185.244.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c017f8f7-ae59-427c-a030-433d59fc804d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.185.72.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7945b44a-6d0e-4a76-98c0-8a48463cca7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.231.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d78bb56-bb9c-44f3-a2a8-131bb3b25c29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.214.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e53b71db-d5e7-4ca2-9b52-ed59d6b8730d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.9.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e7f650f-ff88-49d1-989d-db6b14e9babc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.193.71.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdbea67f-a19c-495d-8264-62111d51c22e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.195.57.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dc39ae1-79d2-4106-b783-d700040b01c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.197.72.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d0d83de-05e0-4509-8d68-eb6226636afd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.198.185.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2513280c-c556-4784-9379-a985c282460c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.198.228.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddfad475-9f3f-4e7a-b34a-397df8772ec1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.199.100.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62fa900b-0d5c-4201-bc92-dd7545a2daf4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.200.195.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1d3edad-aca0-4a58-886a-01d31b0ff829", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.200.216.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaa88d65-adfd-434c-ad76-8148f5fd66c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.200.88.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92158a7a-b421-4e59-b275-7681dd3f31d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.201.198.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38144fcc-daa1-4136-bfcb-f9e0f82c7c25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.202.9.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f98a58d6-6173-4157-af6b-d7ab9a23a631", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.158.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55c8f1f6-7594-49b3-bd83-696e18aaf762", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b80431b9-fde9-49a0-8860-67e27042e63d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1643676e-b068-4733-9292-44311857bc7d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--851a4973-455c-42dc-97e9-a0b251bf0c68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b85551-0978-432f-8146-20a04005e2a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d31fcc5-daeb-4c7b-b50a-c0beb45ec199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8004fc0e-4a21-4570-95b1-5ec8501dbd8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1ecdfc-5711-4c37-8c38-908cefe5442e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--806be357-e775-4ce9-8ae5-8975921eca1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cacf7d0-7670-43dc-88f1-aa692eb24531", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14561081-fc5a-4549-8eef-3ba7432246ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a5d06be-0ee2-4367-b185-e7800be52d73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7359dbce-7c8d-42ad-8c98-3fd75fb28736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--586bdd05-92a0-4b5e-b1d5-986e90d956c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4abadc17-c237-4acb-b268-ed7a483ac327", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbfcb687-a716-4eb2-aa61-fcf19c7be2ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0412a57-e6b4-46a2-bbaa-acbe0d3ba3aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af23aec5-ecad-43d1-af37-2f861b204cb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--361b0d78-3d04-42f6-8325-28ede0181bda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e5e4f4e-8538-4105-bc1f-f7ac452f9228", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fd6d063-fa82-40d8-b99a-b4997b0b3f8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa1e05fa-fe6f-4db5-bac7-9d67e4027a39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb00a627-2306-4192-9140-9fcad3ca6175", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58c0e0c-7eb3-4f90-aea8-99fd5d481741", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6884a319-4bd6-4838-8140-d0d04e436f70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c817d2e-e460-40c1-8cfd-af5e07e55f22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07ec5f56-d2cb-4019-9fe8-6553323dc295", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f6addaa-11bb-47f2-b6d0-88e294c20e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50689f6-4605-4521-8ace-4cc72bef0d0e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9749b5a2-052f-48b8-b1c3-4124a0652f5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d19428-0800-4477-b3aa-524f6f7fe5c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84ca003e-d48e-4817-a95f-52b9d339b993", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb35868-a310-4ec4-9954-07df3929aa4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c3bc337-bc69-4347-ba13-43ddd1ca5318", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ff0eeff-729f-4ed7-a3a4-ec93daa6f754", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0867aade-1884-4395-b543-d3e338b0a230", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ec9c16-6af9-4c3b-894a-8a0230b47ee0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f8d745a-8398-4fce-8d06-4cd80f494cdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad3d463-13bf-41fc-97ea-b029a3d68428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a74c78-69c8-4423-8887-dcc8c503aebc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87cfadb0-410e-473f-a734-6f9dcc1fe1c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9181b9e-f499-4769-96b9-08fe9e822d5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.210.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4655457f-4aa9-4ff1-96a4-3844d0e49b66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0460e0c-3b03-4a00-9786-5322f1e82150", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0349ea5-5095-429e-9361-cb04fc155663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26f9084f-c69c-4b11-98eb-8a8d822d14a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acb445b3-88a0-44e0-b798-2b5e01d30271", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b94c22ab-a52b-44c0-a1e8-db0d6621f9c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b424489d-150f-43d3-b78a-19e64f978404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9df4ec5-5113-43bf-9c31-6fa1b65a546d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cde22f7f-3e8f-49a8-9ff7-4fe35a463ce1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2e3d0f2-25cb-4d36-acde-406412c7f8e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc53c785-9107-49e4-97f9-5b59675b796a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2bbe6bd-262a-42eb-9976-bca95d5a00fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f44db021-849d-44f2-9f21-7f4dbcc6ce30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d510a6f-8c45-4f8d-8a79-e5d7736bce11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--376a7014-79d0-4608-99fa-f09346cec50f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feee65ee-34d0-4bcb-ade8-431a97781a63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a8be66-b7bc-42ee-a876-7c2e8f40172f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f558878e-6081-4d88-92e7-297b2fc8911c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20072565-2b6a-4076-8f07-a5845fa9a376", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2449fd0-16b4-4100-a251-8ab8932822df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acee6e6e-e3ed-4b0e-92bf-a79ca557fb9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37d1ec8b-46be-49a7-b1da-15e75aa5e39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61e2c49f-6e11-4713-a1c5-68092b8ed36b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ae32b5-8ac8-467c-822a-1482480534a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d685f8b8-daa9-4112-8f44-4f7f1963bac9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fec7abd6-81b9-4fc3-b052-4c1eb133864b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a421a8-d606-4909-9bad-2bf4cf67662c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c558920-6166-4dae-8d22-eea345284751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17e0bac1-af92-4f0d-b7ba-e3ba40d14882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44aa0c98-f7a6-4a3d-8580-28595d39d421", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0a92da9-ca13-4ddf-917f-57a326172c11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36c80c83-a8eb-4d19-acd1-a88ceb5a8d8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f7c832e-2b08-4fa8-9580-f3d6c0496748", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252f4bfb-dd98-400b-a2ac-89011949142a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3705e1c4-0f25-4b0c-bd2e-52ef271c7a35", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70641b23-2deb-4941-aa8d-dd598e5bacc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53af3dc-6f73-4d49-9620-f067163d372b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e5bb95c-945f-4c03-8a4a-391d514d381c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--762b7fb1-2d3f-441f-bf14-4971057880e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cce9664-1140-4e8d-ad53-b5acdde4d863", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--096dd418-da51-4796-9092-74b01710006e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0d8ce7b-a269-47cd-8bc9-35c3fe097e3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a26be2f8-5793-4360-a7f9-6527dea8f934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68fc7b03-7ed1-49b7-99bf-5fcb3c484105", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.203.211.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aca479a-6a9d-46eb-904e-60d8a172902f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.187.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--caf38b3e-4d45-437e-a367-eb2a5ac0f35d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.195.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03efa5b3-7208-4950-9066-c30dbf67db3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.221.14.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ee550ca-5016-4f8b-822f-5167e0e9e4aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.222.172.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd61e53b-204d-45a7-8831-86600ba8d4c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.223.42.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9942695-c9ab-4d92-a04d-ec68b908fff8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.227.35.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e77ade0b-f6b5-44bd-b023-7d79ed45e898", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.228.102.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32363096-58cc-4b9f-891f-67ce49a5b77e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.228.114.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abaa2d50-020d-419c-a9d6-0aa67daa1504", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.228.204.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46d7dc21-6b8d-4dc8-a54a-d4f6c1644db6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.230.128.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eaf4e86-9fef-443a-88d2-d4c2ddb94848", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.14.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7fafcf5-8655-461d-bde0-157343b4ff8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.69.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41940590-c3b4-4179-9963-f2c753926adf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.73.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7376f9e1-70be-4d41-a281-db7ac92cd3d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.234.95.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f29ffa7-362f-4b9f-bc80-037c0d76a7aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.236.131.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7747851-e86a-4699-aa47-61efaceea3a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.236.38.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e2e3ee5-434e-4cef-8fd4-aeb39c60e6f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.236.95.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c255535-dd58-4c1c-a612-4c049619ec30", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.237.122.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1879e18e-4e56-48ba-b3b5-acf52400d3bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.237.58.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab427e36-5873-4ef8-9b40-339df683dcc3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.240.121.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3882de03-4bd5-4580-a64c-5d4321a3b0c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.166.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--591e0b4e-3a1b-462e-8012-caa469587ff6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.252.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--182689bf-2793-4cd3-b993-862c86e6c7fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.244.119.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--601ec60e-9c4a-4120-9b53-f84ef175362f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.245.100.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb49f21-3287-4614-9f3c-aa06b441400c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.245.168.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bb85971-d827-4eee-a511-e861435ca91e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.247.244.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd67fb9-5f17-4458-8614-10ff0fd2e3da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.252.181.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c9c2d86-c9c0-4aa0-8f66-99895cd86cc5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.252.6.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8aa35c14-ba40-4a41-b5eb-5b0954c81b3e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.253.247.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43551ee5-5aee-4bee-b398-1c80ab9fa577", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.255.224.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96f472f7-66d3-4c72-bd54-84724ab51da0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.94.66.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14925e7b-76e9-43b8-8d03-9c570ea1b513", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.11.120.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1e8276-377c-40e7-ba35-ed7a877f53d7", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.91.81.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac889f4-6ddd-49f9-a482-d1c15ee1a821", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.99.140.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0030c2db-bae3-4ed3-a4d6-b3fc2738ee4f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.143.61.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--773d94aa-9a11-4ccc-9a89-90d9179c5413", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.186.114.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9080458c-24be-4a44-b5ec-8f68bccdbdb1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.215.47.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d84285af-cde3-486f-876a-b835ea6e7ed8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.48.88.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cb9199c-ea47-4b89-b253-c15f0e259cab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.77.150.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c3c4d95-8389-4a0d-965d-9250fc7aff62", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.78.13.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--816fda77-bb13-4e5d-b2dc-c1d2c102af8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.70.51.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fef51335-bcca-4068-b73f-22d97598fc77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.76.179.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db3cfda-81c3-4a98-8f59-586d929f40b8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.123.249.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e14e87dc-12d9-426f-ab7c-1fd6caac6d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.99.254.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58e37891-feb7-434c-bddf-c1c98a3edafa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.186.40.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1ed4c75-577d-4ccf-9836-fcce5c5378c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.205.23.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15834d3b-db8d-455b-b642-ab63447fb4fd", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.227.178.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7964395-3806-4457-8112-8641eb42477d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.228.83.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e00d3854-d730-47a3-af21-0dac11ff8226", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.246.204.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffea8d9e-7e1e-47d2-aece-8e1c34f72134", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.112.183.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3503ccb-d9c6-4309-824f-814196d23558", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.24.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3842d573-ec83-4769-975b-0caecd29ff63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.28.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a6c7f3-ade8-4bfd-b7bc-933502b23a2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.40.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76f22aed-f522-4164-95fe-2aa330ba6627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.116.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e55ea0e6-e996-473f-8af0-ced15d37d8f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.120.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b61ffa1b-e8f9-4fcb-b47e-441db315b79f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.169.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ce732d-80ac-4ef1-a9da-e9f423a1038b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.170.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93755f9e-4112-4aa1-962e-07bb308adea3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.171.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbcc97f0-5428-4df0-ba0b-a924b5cb1bce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.173.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99d27d0-6d01-4013-b38e-fe375495f456", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7a6212c-a7e4-49b4-a82e-83fe9ef12c60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.174.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da2cf5c9-b39e-4df7-9a1e-e0eaac123457", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5c0a304-ffe2-43f5-8131-30cced18fcec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.175.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c32e01-313b-4a4a-8eec-27024c55a643", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.183.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9786a8dc-e501-45ae-ab98-214d1096e066", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a72021f7-eb6c-4824-9067-67ba0828e5ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.124.186.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--237e525a-ddf2-4a44-a720-2eee8cca12f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.74.208.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f28e6d2-9f46-4d5e-b856-bfc263f96f42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.125.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba03a1f0-d3fb-4eb7-bb9b-73e596806eb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.76.140.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9dda6db-b4ed-4bff-b9b5-5ccb1a2efda5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8541f9d5-af08-4078-9221-ceb778fd2b55", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de0da111-d190-4e7f-b9fd-92d2505a0b30", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67d91e7a-eb36-47e4-b1db-fb9f76231816", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c5a7b3e-a51c-42f4-bb5d-4cbb625ef11c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8daaf89f-437a-4fe4-a530-63139d485e32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--567eec96-a1c5-4eca-9ae9-268acc7de474", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--134354b1-3fbb-48bd-b2bc-1c5423fbc19a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--206385e5-3319-45ad-b5a0-ea1af7b58493", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b307bc8-d76d-401e-b0c7-684e03d2f350", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8283aaf0-1ca5-4b35-b00f-1b7c0883a074", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d89484ee-82a0-4263-9102-414eedfef203", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--220ccc61-b883-419c-9842-c5bd073b3eed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d32b48e6-a275-4ce3-9ef7-32fb268b169e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--855f015a-2d24-4ae0-8b86-b38c23a6bf21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5185d186-2b2e-47b1-b1aa-4852f986260c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984e1570-758b-42fc-a5ac-af780e52fbeb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b91218ff-467b-4112-bb9c-de3581511ac7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9341d640-00a0-412c-9c2b-48dab7af9275", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c88a9c-5cb6-4a16-bead-e8e207c63b38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42536166-cacc-4e20-90a0-424089674922", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e6b9394-4e45-44a6-8d9b-6ca65cc779b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fc3b6ae-24c8-4209-b4c9-1f98bbcaa8a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd1dbc6a-e499-48f9-9bee-392697b9b996", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b24744f3-967e-49b4-baf3-eb19c61b08a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--988695b1-9a48-423f-8c18-9b518127788e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--171d80ea-3691-426f-bb42-9293e04cdc4b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d88cfac-72d6-4cd8-8450-fa6c93b206f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad7186a-5d45-4bb6-82b9-57292b28cb77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02523104-692d-476b-877d-a489595913e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c612e54-9c47-40f8-ab27-5a4702725a7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a077026-670a-4b24-bbc4-0d7d43c88aeb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d703e249-d856-4557-8e29-d736533729a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c454da-aad8-448a-aadf-98134d3cfba3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.77.167.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9444c78f-5e59-45e3-ada2-97ad6a566e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.80.200.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--957f7355-1045-4731-be70-c9cfc7a5a15b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.81.230.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a67ad5-28b0-46e0-a4a3-10bdae2dbe07", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.111.178.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--979b46c1-d5c5-453a-9560-835a4611d798", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.168.10.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c09794-4d01-4454-93fb-22c8aa7fb17b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.191.229.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70777da3-79e6-4021-aed7-bb7c93dcf78b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.216.177.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9c5b739-3e41-4f77-8867-f4a7caa846d2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.249.157.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f784ba61-2bfc-49e5-8497-09f09862eb3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.33.45.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--defbef61-2f2e-48aa-9e28-722f432fcb77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.82.108.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d3a5af4-2237-4b15-9710-d022d3bd065a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.1.120.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2825ab7e-72bc-46d0-8bde-26ea51f21e30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.1.67.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9df263e3-9a4c-42c3-8a31-f7926f9ab810", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.114.214.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63afeeea-fb91-4808-8f24-54b62a7464c3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.123.126.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9abceee-2e80-4350-ba0a-ce8a4ee468a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.193.231.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb8cffe8-a261-4022-b7df-e8d6a536a7d1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.200.81.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eaa8f6f-69ca-46b8-8d21-20fb5be49e43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.202.98.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4d2274-916c-4e28-a054-edd9742a97b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.232.230.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--452871e9-a97c-4941-a966-6f39065c2ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.48.38.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcc4d183-fa9c-4a07-82cf-7332144c1925", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.129.225.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db74bb74-90ca-4203-9cbf-5502ab5c2aec", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.28.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b31fc3-1db3-4ea0-a203-a7189e4f0d9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.78.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12fa7ed7-87fa-474d-880a-2645a42be3d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.162.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed248f3-34d3-4677-811e-328f0a04ad5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.140.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25c19f20-a2c7-4750-b480-9017a737741e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.136.86.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90870c99-d9c5-44fe-8513-6f920167919a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.102.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--482f4ca1-916b-45ef-b73b-7e07fc23e821", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.215.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce998b31-3975-4358-90f6-0c899155487a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.29.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20645768-91c0-4053-ba42-56459d8c22ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.96.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec5a3368-2f2d-4071-8f69-49f73d1b9061", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.154.2.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7c1db9c-51b2-4f9a-86e3-9e94cbcb62b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.157.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73213ce7-1df0-4ded-836e-093d4b486691", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.195.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59279241-0bda-41f1-9d8a-2b3f351f69e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.31.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03715777-1702-4fb3-9368-e9473ab690d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.90.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edf29abe-5e91-43e2-b155-ad0983a96486", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.153.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03b8a73e-441c-4298-a463-7207ea7e16d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.168.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b0e714e-740c-496c-8bac-c1f851dcd39f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.174.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6ea6737-a9f7-43da-9646-773c415b3e13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.180.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--579723d9-e3e3-4136-8360-eccef5867fdf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.38.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef5fc880-4775-4e3b-8870-225e1fb5995f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.98.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1b68a63-af9c-4c40-8b91-cbf2abb56802", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.135.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b457fd1-3b79-4f16-a69f-3bae4a0be4d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.26.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96d04828-c2ac-4f42-8455-d6d1d8f0c2e0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.190.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15dc010e-07c3-47c7-a83c-590ddff20a70", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.125.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62a2fe1e-3709-4719-956e-f59c9cf5f932", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.3.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9e95617-8bf9-4dca-923e-6b9131d4d166", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.136.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dfc0271-cf86-4ac7-a496-b9402d68db5e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.242.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0daad5d5-a41d-4367-8ce6-bd385e72b0df", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.247.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4799e5-0b3c-45d6-bb59-01c52fcc40ed", "name": "Malicious Host", "description": "Observed: PORTSCAN, WEB activity. Sensors: cfglobal, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.255.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9df15da-ca39-4780-9d1c-9043f2607876", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.245.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--546c4b20-d493-49f6-889f-e1b74ec966c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--915001b6-2a04-4b7e-9862-93ac7b3d90a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.194.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68eaf841-5a91-4ef2-8ac0-b0331e692cc6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94f8980-2bcf-4787-9610-c4b05e57fd3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--641e410b-89d3-4aeb-9ee5-c5543abbc692", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.178.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--024dc756-f14f-4846-9e1a-7e7a88f11a1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aebce6e3-0bb7-4027-ba9f-94baf269ff38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72f59719-af7f-4609-8a0e-d557f60fc842", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.181.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7741d04-6fbf-4c3b-a962-76714291f3d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b16b637-9c7b-4244-aecc-9605e23f9cea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.224.126.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2942cbe4-e6e9-439a-956a-7218c2a5cb5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.226.37.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5611ac52-47a3-4a1b-a095-f8ea4f74ac60", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aff1eea6-ba09-4329-99fb-7193ac6113b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ebce87-6492-44e7-8621-78ad8be55090", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42cde192-da06-452d-9c3a-7f38a9e68389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.228.157.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69fb43bf-288a-41e1-a82c-5601d7fa694c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.240.55.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4a9f8a-8564-40b8-a09c-960b2ce4763c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.245.97.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa04aa67-b425-4409-9e5f-7e3134a49e24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.248.109.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734e86e9-9725-49c5-9125-8d3ff3178d97", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.252.230.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe9e0f82-a7d1-44e4-97a4-64dd173a061a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.201.224.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc7f9e89-1a2e-498e-a7b6-6d3af83b2e9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.202.33.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed85164-e374-49a6-b7ea-db0e7d993d32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.203.252.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--488cae05-d057-4fe9-8efd-85b394517d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '44.249.242.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44d9555e-d192-4996-a2f6-dbe46d03a43a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.11.57.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9af0a759-0da8-48a8-8dc6-2dfc15309b86", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.112.149.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74a408c0-21a9-4e06-994f-db69a44b19a3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.116.78.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e975826a-8a92-4f45-9e5f-06cf1868f5d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.12.254.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00a8575a-c696-49ea-9c2a-9faaea101060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.120.126.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50b96ee-1058-42e8-9f17-19ea2b34ef2e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.123.110.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d765e03f-2f38-4939-b1b5-1e60c558f024", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.131.46.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ff0f49-daf5-46c8-b67c-378044dc8895", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.193.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a223273-7291-4184-8bd9-120c1f0c7f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95a09071-4002-49f8-9eec-080c529486f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.135.194.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39796470-64c0-4aad-8720-1b0c4189ee19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.137.126.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8518c2c-a656-40f8-bc98-fbed32f10e04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.16.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f95b2db1-4531-496b-a1d2-72ac94ba9f09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.141.233.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8324f0a8-604a-47a7-9707-7962efe22d9b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SIP activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00f2bb12-1e28-4ce9-894e-15678bc3fdb4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7745584-703a-4e53-9330-433246261034", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.154.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3ada730-a2e0-4291-9eb0-19a96221b241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db589e61-e3ab-40f4-a5cd-b7ab2e0a1bbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--719e762e-f991-4375-a480-a3d9e57c1ee3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--637aaf99-3dda-4e6d-b8c5-0de024069441", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be89a87f-c2d6-48cd-a5e9-8d59b478cdd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--157083ef-4754-427d-86c8-b1d4e7e98da4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5c48c9e-ee8f-4966-9953-d3ac3a68fef9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4ff509-5292-469a-ab01-63a0712c21f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50a02043-2c45-4c5d-80b0-473da06e7d9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ddbe416-8b63-4369-9810-ae77f6b96433", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab6964c-d640-480f-90f9-295b4f1af9e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.142.193.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--883b52c7-b271-45a0-92ac-42661e98d1eb", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fadc886-1583-4827-931d-94439bf3136c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cd4a41f-0503-41d2-85a2-2e9986707fbf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58399a1d-3bd6-478f-82a0-2a1467febabf", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--098bd1ab-148a-478f-9965-ee660b9380ca", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6133a4bf-23c8-482a-aacc-d0c24cd30608", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93e57bbb-3308-4274-8aea-5f2b7d37784a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98f279cd-8c77-47af-992f-b41e4acbd6b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a65fafe5-5cb7-49c8-8cb9-ceca136859f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.145.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8eecbd94-1490-480f-8e55-f27fd91cc73b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbe6ef5d-0365-4904-a155-f7aba7a4461a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b03db77-5eba-43e8-a0ff-f2ced6217fca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4704259-70f5-4ce1-9511-b031d92f72a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.154.152.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8432cda-11bf-4c27-90e4-e81c89b8c7a7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.154.244.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e318641f-9d6f-4f78-ac55-a3a637be8966", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4698ead-3cc3-4772-b84b-68d8f14345e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74df525e-0041-4992-be8d-49ac8b918044", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af211e90-316d-4ea9-9a1e-ed83c1439440", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--866b0c43-1d66-4385-9883-abd806252d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5c9c46e-e7f7-4775-8ee3-66a70218904d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.128.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--189b2e81-57e3-453d-a989-46f6f2cec31c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ef7015-505d-47c6-a8dc-3cbdec2667d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e162df-3ffb-4ce3-9690-24ca6d5b9907", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4e9fb6-fffe-4901-8f57-c890ca46e5d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--975f1c10-7b6b-4994-b3a5-f38a07ab1ca4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--881d74fe-f5cd-42fb-b43a-897bb3bcf742", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--320950ca-171d-4cd0-9cb7-d95d4c598b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f42c22c7-55a5-4447-8445-1a13c78796b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf11472-2659-44ba-91f6-7afeb371a1bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00355a12-185a-4761-bcdf-95d482012300", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.129.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b56132e-2509-4fa5-a652-ea8912ca0970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ca357f5-9589-4aaf-9382-3bf953500d59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49710638-9af7-4bc2-b1af-5fe7c3356fbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.175.232.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--725c6de1-fce2-4314-8c14-803c23e6f620", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.192.184.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620be3b8-5a1c-4fc0-9adb-d0c9a2e2c63a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b0ee23-d4e2-49e0-89ba-9a9eb1d82791", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dbc5de0-49de-4952-aeb0-fe205efa7f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.70.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dfa3594-6de5-43b4-a278-28eef0928b73", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.194.92.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb677430-adc8-4fc1-87e4-20d047302de9", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.250.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2776d06a-0989-44e6-9cb2-b596e32d143d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6beca09a-4e48-48fa-9850-0fa2d62b79b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0481859-4666-4adf-aa0e-743014a760da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b794b39-099e-4760-a409-aacb90bb173f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--460ce4ba-4ab2-4f7c-8d98-5258d91ac781", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cff06a-5eae-4130-b3a9-cee4749b5010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15ce5723-500e-485a-a509-f81af7a7196c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee4e25e0-c272-4383-b6bb-aa7da623f467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8616158a-38f2-4364-8b5d-30dae6031315", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b0f2682-919e-4d4c-8d59-fbdfb6f00d66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--721c9081-f3b9-4435-a592-c298ac21f11d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec35fcad-ecf1-4aa6-9a3d-dfd5f76e87cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eba47daa-5c3b-48b7-a95e-3630f0357266", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.217.200.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01d82ff-0025-45b7-9702-58a2723eced8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.224.70.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a22825e-14f3-44d5-9618-c16544c4f98a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.226.104.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7b9c47f-a2d7-4012-8d8f-ec253f9dcfa9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.227.254.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a712eba6-8904-4ff3-b039-ed49e79f93ea", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.234.86.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b909bf54-fb07-4bcb-a3ad-677c6b56f38d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.244.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42c534b0-9d75-4991-a95e-9054d02de3ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.249.246.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47c74c18-70a5-4ea6-a13a-f9fba6bee157", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.250.251.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d765397-6f5d-4677-8565-da1f08fd00cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.252.188.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc76d65c-85ab-45c9-aa78-178dfd703d26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d11a715-1192-4d4e-bd9e-89d5c7495de1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.105.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c125aeef-48b2-40d5-8faf-ec7188506967", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbde4d6f-f7f7-45f8-8203-65d8999cd86a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e943f889-a8e7-4993-abbb-43de6da2ee21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.109.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee860032-52e0-42e4-ba33-fc4f390b387a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.110.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce1cc755-a30a-48a9-91d9-1042e42f6582", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb11f51-1318-4dd1-be63-dfe59c0e295e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.12.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f10ee98-3aec-476a-841f-d12014bafa68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.40.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b864d379-50a7-4de0-96ea-95b0326cd1d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.41.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--defe4280-783e-49f8-8e7f-f9cf5e4c13fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.42.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67c58f33-009d-423e-a627-16891dd03f39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.52.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a57114a-bd5a-48b6-9342-1908d937fcd9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.78.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd86a198-0d39-42d9-bddb-9239a7cc6879", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.80.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7471464e-cdfd-47c9-9a92-6be5852ebf3f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.84.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddd49f32-87ae-40c7-95d4-7742e0e66650", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.89.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8a98d4a-400b-4b08-b382-ac68afde207b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.94.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d45b0e19-e7d6-4932-a8b7-85ff71e9b164", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.95.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70fd2d6d-e3e1-4078-927e-dae8ee48f9bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.33.96.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7a267e8-67f4-4e18-bcf4-96f268706b64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6e2ae6-f56e-4482-9d49-2c436721648c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.40.57.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d3e1c9a-e89b-48c9-8260-57ce73179d5b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.42.88.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a5aa93-b62f-459f-9d29-eb6628695c6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.45.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--efe03bac-ce67-4faf-8ab2-7a0e49f76b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71ad433f-227a-4b3e-9cdc-79387239ee8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fdce8c5-b21f-4a22-afee-c3b41241e5d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70d22c84-a848-410d-8f8d-47e4a5ffaa36", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.57.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea4202de-fb12-4f4c-95b4-7ab6157f96f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52368033-6bfb-4a5f-94c3-732f2a4c7b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b301fcf2-0098-4301-b5ab-12be40e84036", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc2f0e6a-e825-4f49-a9ac-adfea26fb6eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.58.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4e08f3-e3ae-4ce9-91b2-e7ed43343a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.62.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e92ef3ac-3e5c-4988-a6dc-a3ad09a9b991", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.43.63.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--875a32d6-a897-48be-b8dd-b2a7779924f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.153.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70c8a5d1-f77a-489c-a556-62c7c19c3f3e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.249.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d20e84d-e1cd-4c1e-831d-3dfe46abb478", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.111.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64dcf44-3c27-4f64-84cb-0cbd06b818c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.79.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ad01185-c76b-4f62-8210-dabef50d6275", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32276fc1-e8da-437b-8f78-635bf90b0e63", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5654acb-3779-4099-8efe-4fa1494591be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.83.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e1af656-e405-44de-8543-fc72a11cf511", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.84.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f833f224-618e-4f24-a071-1dce9ecd8fe8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.56.85.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27701207-6eda-4fda-baf3-52856d6dea4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.63.6.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb8ecd1-9a2f-425b-8e2e-48624c31a4a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.64.134.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74d7dcf6-2369-47b3-a61c-fdfd13b55f96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.66.249.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60b2f242-3a19-4067-9756-66b0be4e450a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.104.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b22268-5b7c-422a-b0d4-08e1157f15d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dbc4717-c741-42fa-b700-ee22566a7f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e519cec-d233-497d-a42f-390913a3fa77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7934a52-f102-4a5b-80fb-ad26dcb321f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.109.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b5af80e-2f95-424b-a90a-a7844f2f7b07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.114.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc5b22c7-a945-4d5e-81af-1e013aa49145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.115.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b216bdb7-182f-4bbc-8351-51cdf524c830", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.128.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c36a859-10cc-4dcb-b30a-dd65349596f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.132.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b85b2180-1dbb-4858-898f-c314ff7e40dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.152.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d868f186-ddcc-412a-ba1f-06556e8c5cfa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7dd9597-d297-4ace-9d97-c9002b16bd4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.153.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50f9072d-68f3-4f6d-87dd-2b7aa328355e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.163.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdbbaca0-5ae2-442d-8e8f-ce46ff0a7e42", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.168.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acfffd73-a0ae-4c9b-8f66-c710c012de54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.175.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd62474-0ae9-4659-8903-3711e7316abb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.177.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd29de53-2b44-4015-86b8-edd5629d6a49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.186.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28cc8f46-5e9e-445b-9d90-de76a2f47865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.190.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ada75c9-301e-4202-ab95-eca9ba768e04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.191.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f451e014-0a56-4b85-b04e-1eccd2eb2c6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.192.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c742c40b-b257-496e-b90e-421e8a4952b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.207.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e66b029-d050-458b-a6d2-3e70f5d899d4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.211.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b9b12da-30b4-48f4-a5be-93d45555fda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.225.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--295fcc5c-b65c-4643-a639-e5588afd613e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.38.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20a406c8-d640-4b48-9ff8-2e8039d54140", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.40.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b4bb346-6bfa-4927-aece-7f07cba41bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.5.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4567d02-9205-4c3c-8444-f47fc7785735", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.67.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b39f4da3-a951-4605-81a8-84ea81bd2d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.8.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87c142a2-b2eb-4be6-a457-ed79a5723f52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.82.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--668c2ae8-52d1-4367-961d-16072d43d0c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.92.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0ff5394-3290-4eac-9c6e-beb818c4b4a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.79.98.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbae4354-a68a-427b-8245-7eee1b7faa7e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.83.141.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e1c7ee-52cb-46c9-af79-e6d03bcc4bc8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.88.0.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da0d97af-5696-41bc-b3e3-01494ed683cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.88.186.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d182735-f2e5-4999-81b0-fdf70098870e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.9.168.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df972c00-d76c-4d59-92d0-af94ae06570b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7492515-abfd-4f90-9b5d-69e462922217", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.91.64.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21013657-4a65-41fd-9cd5-1172b663d238", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.92.1.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e685c4bb-137c-489d-bdac-413c9562be77", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.92.1.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4ed624a-eecd-462f-b735-2ca9c8458ff2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.95.233.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb8f7a05-f881-45c3-a20d-177493e21ca7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.137.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a909c2a3-455f-40bc-87ec-d99c6422b54b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.185.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--054acc7f-e38f-4eae-a78c-96a7e3336da7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.101.233.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240affa5-bc37-4dac-984d-0f233154b9f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.105.132.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c76c7647-f849-4c98-9b5b-697e3ec4548f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.191.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be35f52f-b8d2-4bca-8dcd-6834e8edb49e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.151.178.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8f4270d-8cdd-46d8-b108-436228266f67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.217.211.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ad66c4d-0a38-457e-8444-09a44b594fcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.250.172.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e065350-a772-4a7e-9f84-dc34d4a7a548", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.250.175.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d56dc2e-6929-40c5-a1fd-7aa6d326551e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.29.234.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--521835f5-0e6c-4bc5-8958-9a5e8efd3b2b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.29.238.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--448215ad-7de6-4569-b209-ccb1884aafef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.70.206.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2495ea0c-4cf6-4d97-90e4-f480deb13a87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37f749f8-6be2-4dd8-87ca-b1b4810a0857", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.123.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22d4757d-90a0-486a-a9d8-8abd58753348", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.227.176.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98e910d9-80b6-4540-ac4c-d3cbe573812e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.141.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b2e2c01-b209-4ba8-abd1-4881740331aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.170.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eebb010-3fdd-4f18-b67d-3564e9755f01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.189.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f91e9626-8cee-483a-9aae-82062ed79746", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.68.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e56b6135-0eff-4f5e-aa82-53ef511f8076", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.195.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4997fd4-e132-40c8-aa3c-0fa8140195b7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.237.201.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e735c178-51cb-479f-bb49-38d4fedf2e4f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.238.87.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d091e1e9-9f3b-4871-a3e8-db7ddf2ff01b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.10.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e078b0b9-88b9-4655-ab1a-f4f5cfe34b6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.10.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa51306-efcc-4b14-9ae8-b0e7d8779d73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.102.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9259a270-e8e7-419f-96c5-360e0994d461", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.129.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae10c531-dce7-4f8f-833a-81df3d7f8975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.131.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff187cc9-eecd-4138-af7e-f01b48c2eab3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.132.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b0a69a2-e1b4-4921-b030-236a33a53ce0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.137.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5e2cea-d94c-4a89-bd9b-5dfd6332a152", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.138.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b8b49b9-0359-4ee6-9ced-338f8e5da35d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e14d260-fac2-4a21-a864-0a714887ea27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.139.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddafd289-871e-4ff8-8b02-47d0af3708fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.140.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4bb80e-7e86-483f-8130-5d111194cd01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--869ba52b-4c29-4219-b2d2-4e26955ec9eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.142.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c58dba8-4e0a-4f8a-b1f9-a28d90b5b477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0238b86f-f3ca-4d0b-8975-d803d7d017c0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b16da12-e7a4-4a7b-9abf-a0cbc69aed51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b102374-06fe-4044-a470-59e6c7bcc2d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.143.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb92d7c-295f-472e-9061-05a1b7201af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.28.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9ca396a-ca28-43f1-886a-74c774cbdccd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.56.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--078e0e72-2005-4b41-9445-014260bdb6a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.245.80.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3294a8e1-ccd2-410e-9c7f-85cdb229b1d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.113.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f81da208-af25-4c4c-bb43-c23d46cd1a6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.129.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2411a42c-b807-49ec-a45d-ac82af9fe21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.135.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9cc414f-a23d-4cd3-af19-f74c0532cf82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.142.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--faa03199-89fb-4357-b56f-fa5a07ba3410", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.146.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--289276f9-e223-460e-a005-7939109a4ba5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.147.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d95800d-c3fa-43c7-b94a-54a3cfbf0b1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.153.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9123af9-1da9-480a-9f96-4e9a5706c481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.161.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7adbea27-9d76-47af-af9c-cae75dee08c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.178.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69b01503-bf5a-4252-96cd-df870cacd658", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.195.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f670658-3261-4c31-b7c3-c8fe7d901088", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.37.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95116fe0-4cf3-4429-98e5-59d84f525a97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.43.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f65a3ad9-c083-4a91-a6de-1e58f504e45d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.43.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8283857-b5d9-418f-a525-a7cd4e5f8706", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.46.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf124b74-f902-4ab9-85c1-d673e4452316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.48.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7055bacf-cbfa-4a9c-9d79-a95b3a7bf5cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.49.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4df1da0-7e00-43c2-9813-3393c821c111", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.54.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d76b5ff-c91b-4e5f-bb4a-e378b36e5e7c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.80.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25e586a8-e2f3-46eb-87dc-862ff0dc7956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.81.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d20f842-c0d4-46db-9037-4153f8ba2eae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.83.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d5e18d-6e53-4231-8580-765ecd61b489", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.87.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--241661df-bb5a-4b9f-881f-ead77ed4cbf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.89.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fae48e48-c033-40c0-a5bc-0d6257dc81fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.89.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28fb0579-d6b6-4092-8ed0-2839d61e85da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.89.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--039f219b-69d2-4886-a928-b1608666e334", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.250.95.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2474cb60-4c52-4931-9d47-5b8b9965f3c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.100.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27aa73e6-8b12-4c43-827c-354da17cc086", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.107.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c55f53b-d389-4698-91a5-7a008e6dc4da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.109.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d4668fd-3eea-4ed0-9593-32dfdf175a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.111.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f79306d-ca7d-4fc4-88f0-35245d42efa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.118.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--824c84be-7728-434b-8f60-f1befe7867ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.118.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1a66b3-bf59-4968-879c-67455e9d373c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.124.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a62faf0b-2219-4743-9097-1da1cc8c91aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.143.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--803847b7-b86f-4ec6-95d9-03b7fff45a85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.186.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1789c4cc-d9fb-4516-b9db-b73dc7969830", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.190.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94985467-3409-4963-a923-7292fb9965fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.191.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ac5766c-48af-4bf6-aafb-6514ef0f1a37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.22.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdf39286-655d-47dc-9f92-fdbbe11a050e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.244.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2586b1f-6009-4bb7-a067-9ebab1133c07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.246.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--287e8656-f04b-4485-9674-cdbcc19e48b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.248.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0106187-f604-4042-885c-402d7428a4af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.249.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d39ea6-ffc3-4fdb-a050-09e936c1a3ef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.252.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8273ea39-e717-4e1d-abae-97bdb13d5b6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.252.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d3633d4-68de-415f-8cd9-3d2750b00b59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.252.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11423ab9-4f00-456e-bf0d-f186a1e900c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.28.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c808ebd-ae37-4173-8238-dc2e4c9808f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.30.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbf032dd-5289-460b-b2f7-0014a5157155", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.40.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2833ab03-4607-4bbf-af3f-a2ee77ca3b94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.42.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c61b77f-7cd4-4938-9431-e0f67acfa882", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.42.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--871a3531-dd9a-4362-b943-083a164787fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.45.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6398ca83-c129-47ab-ac33-ac0cc3fedd5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.47.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9426c4c0-fc14-4b17-822c-1353284ce9a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.49.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bdcd7bd-0c41-45ad-9666-d86fdc3e79c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.64.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05de26f8-4ee0-4ae8-b685-5fdd22d8c6ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e18994-a0e3-4894-97c7-2ca0b981aea4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.65.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64609abf-a7ad-4018-a275-16ca2fbed07b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.68.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d4f440-bd36-425c-ac5d-ad5654be94e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.7.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c460bf88-d4f6-4497-adff-fe03bd48fcf9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.70.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c25f18a-13cc-4f3a-b291-c68dbb0be21a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.73.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c6d1998-e1fd-4abe-801c-992b149e3176", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.78.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de9b63db-4947-44b5-b3fd-a332d72c2ddb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.80.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324a84f6-04b2-40f6-a1e8-40da238d2c8a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.81.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d46aca1-046b-46e7-a506-0cda2b9cb616", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.82.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89fff459-21b5-42cb-976c-d72883bb1023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.84.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1871ec7-f8b8-4ea4-a16f-06fe59a40a8c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.85.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14349f2e-0cfb-4a5f-bacc-f8c3410a5673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.91.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73deb00e-a36a-4e8d-b970-cddca306f6f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.93.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--307e232f-c17d-4dac-a945-e62bd0ece437", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.170.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff7f91b7-e5ae-4f4a-94aa-0b79391c128c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.253.5.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96a8cd5b-57a2-49e3-8042-52fed4e10e6a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.133.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--543e1784-cc5c-41c5-901c-40916e7305c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.134.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6f1ad5f-9fd0-49ba-85b8-2b9549b04402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.135.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a4d789-db72-4365-8690-197b64555f2b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.158.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db86d5e4-52cb-40fb-a424-8423ce72da69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.159.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f58d2aab-dd81-4a86-b566-d0f88f218732", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.178.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edf637fc-a7d8-4575-a4e0-5cec4516f34a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.195.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--265202cd-5b08-4c9b-a346-95a659658aec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.196.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bf52272-92e1-49e4-a741-9e589202b5f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.200.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c0aff77-3108-4f13-9303-1eace499dce5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.245.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef9fbc1-aad7-4d73-afcb-1b7cd6dffdac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.248.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dacb4fc9-6c8b-497f-a131-a8243a4bade8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.255.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de0864b8-488e-422c-80d1-c147923805a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.31.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0834ad5c-1788-47a1-a9f6-e90f3fece96f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.34.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d03481ff-222a-4f27-a331-8e08fdd424ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.36.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eeb7a758-252c-487c-b02f-5906a3df4ede", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.37.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c4f49fd-790f-4569-b82d-d25b97e62859", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.41.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f702cec-96ef-4951-93ae-4353ab1c59ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.50.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2aa323a-156c-41a2-9181-5a03c4895e61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.53.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4b83890-99e5-4659-afad-603f69ae1fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.254.64.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f4af87b-e211-4d73-a800-4e7e6f73bed2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.182.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e68a22-63b9-4bcb-a0ea-ab735131bbd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.219.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a82e8c5-1a99-4149-93e3-a84cffa51528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.222.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2aa9e5-4338-4a3e-b81c-37434ee737c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.224.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec0b5c9e-128b-4fb2-bbe5-96b21b08c8f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.228.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a348b62-5583-483b-b751-828e0b29a3e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.230.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c03a06ce-26a1-490e-afff-0ee0b21c3cbb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.231.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a090fb1c-21e4-473c-8ae8-72db780cba4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.77.231.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--639fe806-fdc4-4952-a7cb-1619ca581f90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.83.254.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aceea390-6537-42f0-ba1d-7818d53615aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.100.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50725b94-32c5-4035-aec6-06e0a8178835", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b68d8f90-81ca-4743-8930-c5bfc392dabe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d39f6b49-90d5-48ee-be1e-93856455782e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.101.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d374b1-5185-4d86-90bd-fb1ea1abe067", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.102.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4be263a-6d09-4f46-a60d-cad007c481d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6a864b4-7b08-4e54-83b8-d8da783386d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.103.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81eb456c-a3a9-4113-a78b-e1a58c3ce120", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.106.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66edc77-6584-4749-b37e-00a42f1394e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.107.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b0d8ef-581a-493d-8215-03e0da3da258", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.109.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b7dcc5f-c06f-408c-abce-286b0c87bb32", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--277f8150-a1b8-4fc6-9eb3-4c0c4b498b81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.111.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5865e9e8-6747-43cb-9ba4-a036c2807573", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.113.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d99d4bd4-02c0-43d7-afca-3d052d32c66c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.132.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee225802-3814-439c-9056-800fa40a225f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.134.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--febd0fe9-ae3c-4048-9fe6-3aeb2b4a8ab5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.136.216']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f4da851-7916-4142-bcf1-df3e02b6ac24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.137.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74f108f4-50d8-4623-bba2-e87cb50a8260", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82eddda7-0aed-402f-9037-be6e1e81b006", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43b26c5b-7eee-4716-a27d-d2a1c02ed8f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d165b3c2-93b8-43bc-b852-52b96c92ff80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.138.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5c4cc62-7e1a-4c98-bfe2-a5c30cc024b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b08bac-ae24-4f85-9ce3-67a0e6f52cdd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.140.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e19b2b-02c5-45a7-801f-03a5d75e19d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.142.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e8fe21-3b92-4c19-95ad-32097c7c9389", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea74ce68-68bb-4ec3-97c1-7729514c84f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.143.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ce21777-dfc7-4066-8687-db884c4447bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.183.108']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2328c490-257d-46a0-ba46-d390ed953673", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.187.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b1dd6bc-7678-4a99-a8ae-590f2f0f34a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.190.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f61604e8-496b-48f7-b802-e16474db538b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.84.204.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48f2348d-cd99-401b-bb30-786ae8b2de9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.29.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9724ab38-770c-4daf-af42-68434c208b54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.88.3.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b033515a-66c3-40b7-8a33-8e63e44865d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.230.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2585fdcf-7298-4729-a583-124c05ad1e01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.234.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae8dc945-2520-4a4a-b4fb-c8c041f1cebe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.240.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4febd915-e637-4f32-9b2a-088996cad68f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.248.96']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da87ca90-d3be-4348-852c-b3063b0b314a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.89.255.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b98d577-8a82-42cf-a212-43c722b4c540", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.91.16.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3512968-d04e-47e1-b356-26e829f4db93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.95.228.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b00d74-48cd-482f-aa0f-ee978f57079b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.95.234.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4413839-4376-4355-aaa2-734cabf3a996", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.214.144.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631cb7e3-de1a-4965-9dce-6b7e882263fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '48.217.187.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8dc5411-7ec1-4bb7-9f80-1ebf4c58ea36", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.205.183.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d97fa1-1a15-4fc6-ac2f-31008cdcaa4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.243.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4c14c82-a144-488e-bb07-a80d497b527a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.7.214.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46a629d2-3d93-4ac3-97a4-f342d01ff685", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.120.174.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e9292ab-ffee-4dc9-8959-70cc78676387", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.167.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45c27f18-d163-4ca7-9a31-9fe03c383137", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.175.169.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee3eda72-096e-446d-b9be-a976143b562f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.182.204.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37577b5d-c328-463f-bc6d-83777ec53d90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.182.83.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dd296c8-b55a-46b4-848e-83f781aa3aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.183.101.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f375f572-046c-4f7d-bc15-0308baac216e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f82e0cf9-24cd-435e-ac0b-f7e1bc123846", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.187.35.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5f1e861-9686-49f0-9c13-f48a93626816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab584ff5-d84c-4b6b-847a-177edbe02b3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18469cfd-6a88-4cca-b7bf-f161f1d31aa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.188.206.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54f35833-cab2-4b2c-bda4-2b940f7c1649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.130.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--729e9dde-650a-4faa-906e-9a7d5d7d49da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.189.132.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edb57862-2e47-4dea-8f55-1628b5e749f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.193.211.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168180e8-69a0-41f9-a061-8896b0b29aa0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.223.67.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--391c83c6-6046-4aea-8b66-7d22403a388a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.238.24.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ba72ff-5508-4dd1-b563-ae58dfb807d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.254.85.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6f5e271-4348-4a6c-8215-4f0c369f9dce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d8a277-bd5a-4135-bd30-2d4b4156ff87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3c6a203-133c-4f67-84e6-0234a13e0207", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2023-1389. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.61.209.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--316cb3a3-8044-4585-9699-44a29b8bc736", "relationship_type": "indicates", "source_ref": "indicator--c3c6a203-133c-4f67-84e6-0234a13e0207", "target_ref": "vulnerability--e77df12b-61de-46b9-8f9b-1865b3947d37", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb069513-585d-4ff7-8340-aa73dc101e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.83.143.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49fe391c-aee3-4d97-a52c-7b3aead739cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.116.72.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--325a3a2a-e8cf-400c-965d-a156b5322320", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.220.227.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1fa3c7a8-12ff-4e8f-9d63-09e8df06ee4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.39.155.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aebe53de-7cc0-46c6-86b6-e2bcfb6ac2aa", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.56.159.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c9754b-1619-4320-94e4-14504e185d4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.6.197.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ea76da4-e26a-4a6d-8156-d3012c4614df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1ff6253-a9c7-4591-9254-a803c2b0b969", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.158.205.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f626c2b6-8928-425c-9d1f-417cea395dd1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.104.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6085296-fb86-4c89-83ee-08145f2bd1ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.110.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2b5932f-2c7b-4e86-9d5c-4f8853dce952", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.159.111.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cfea9ba-b14a-48b0-adab-71fb6fc0240d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.222.96.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64638990-643f-460b-adda-1a38fec2e2f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.254.59.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19915439-c154-47f6-9940-42e91dba8c9b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.255.66.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8fead2ec-c3b6-4695-9f76-300533b01d7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.103.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997fa5cc-b219-4c6e-9a5c-ff32749daa7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.75.149.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41b44673-24ae-4ac7-a599-d1e151a902b1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.75.64.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52aa5887-13e6-4166-b152-dd9e86bcdc8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.77.222.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fc15adc-26a3-493e-8d45-06525b7c19fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.79.177.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15dcd9ac-d12b-45e9-a3d6-e0a5fef916ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.79.67.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69d8574-78c7-4107-bca6-b6e76af25704", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.81.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d553d067-06f5-4013-8cba-fa8608185f2a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.88.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a905883f-2d84-4fcc-bbb1-185fc13847fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.165.89.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f87c8050-ffd4-498c-b559-33ca2322dd8e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8be019b-ca2d-471e-ab85-17129926f17d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e14065-a2a7-4189-bfa1-3426a3f1fb54", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e86d6db-cbe3-4c60-8162-6f7bcd38ee7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e8d638c-df11-47b6-a82f-3a6bac1cd695", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f5ed9e8-9e75-49f8-8df9-278065b2e667", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f10801b-e5b9-4d42-af2e-5a63020b7b31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5d1c877-c55a-486c-a1c6-f8621d6b6bcf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76ce43a2-427d-41c7-81cc-4b3ef6067f92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef81f9cb-845d-4b6d-8474-306b2ba7dbb1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e5c21bf-01a7-4c63-af2e-5931bae9ad4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3764b167-dab9-4235-97b1-9c5ce9a5fcaf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db43f8c5-23ba-4c7f-abb2-38251db25e2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d4a1892-c9b2-45a0-ac6a-909b6a3ce20d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67aefce7-9c5d-416e-aa6b-9c3e7d832a3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--503b329a-7359-4356-9117-044630530630", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e60918fc-9e47-4956-8cfe-fe5c19a5f001", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbacee14-281c-45e8-ae9a-7d5d4fed7642", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28027e83-47fa-4eee-a823-20a8b2ca8629", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05777072-4670-4471-8423-899aa9399e50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98ae59c4-834a-4194-95d5-14fe731554c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e944f8-182a-4360-8aa0-60e78d711265", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b296cc-b1b3-45a7-b787-bb0710d18de4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a0a2319-de3d-4552-b7e9-0dcbe71b3272", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--596638d1-a2f6-4d7a-8ec1-267f59640c6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c364aaea-bd78-4fd0-b07f-dd1baec3af61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb0bd05-9b4e-43bd-b7a9-d5e78b50887f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b15d20a7-ae71-4e1e-ac0e-470e5cf20a28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f26e2e54-6698-45aa-973f-a7debfabce2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c66cc51e-8eb6-444b-9a77-675182d5c543", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5dba0ba-7e25-4f34-ae46-124b6d6ddf55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.137.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32c3ca4-f149-44a8-a119-a9189a612d25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.137.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d080f2-df11-4c07-904a-7b16c98525c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.180.144.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31e33222-627e-4bb6-87b7-e15796e09b6c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.169.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd3e4ed3-5128-43d7-937f-097b6f6bc1d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.186.182.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c01fdb58-6ca2-4c57-a5bb-157e05f37d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.188.231.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0edb2a26-e3a7-4877-9ab9-990ae71bf459", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.20.198.190']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a23cd016-803a-4d4c-83ed-21a5fea90398", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.204.132.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83ffc4ae-3aeb-4b87-96e0-f321eed463cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.206.61.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ba53e30-9203-4738-ae1b-d6e752df8141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.207.196.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd4ade97-595d-4f11-8d83-ecb532f0051c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.224.241.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6814685a-8978-41c9-a32f-68e6f8b22269", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.6.113.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d284c0bd-8570-4f55-a4e5-908e20e43ddc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.7.45.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b79bd5-ec5f-42dd-bb25-9fed097127e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.70.205.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a28df4b-9b51-462b-bf3c-5cb2b86455ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.90.148.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e274ee-b602-495f-ac38-a188f8539870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.91.1.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb526c04-dfa1-4234-b6dd-80773326f267", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.176.191.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a69be44-e1aa-4c15-92f9-18b4768070ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.196.157.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2972d71c-7482-4d0f-b9d6-4e8ba0f18520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.221.33.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a294523-8162-4a03-bedb-e1132af4cad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.227.40.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cc196b8-92f2-4384-957d-9a5e0149f6c5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.227.93.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e96569d-e34e-4013-b569-bf0a2c3cf241", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.99.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b6e3884-8cb8-4fc3-a8b0-d48f6c7b458e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.151.99.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02576a38-d142-498c-ba5d-b051d5a264cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.154.241.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d440032-34ea-4122-a2b3-9539c79849e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.186.20.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c30936c-aee2-4ea4-bd39-843c7ee6a430", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.220.17.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7adfa89-e71b-4e9f-913a-4fd8ed75e714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.65.142.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23109063-19d2-4226-83b4-edba71933b65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.103.106.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685ee17e-638a-4d45-afd7-f748361b1b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.125.215.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3976005-79d0-497b-b2f1-aed7d1cbf7e4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.125.230.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--540bc0db-d268-4432-a8a6-8e94af3a7201", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.149.239.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d02a526-a74b-40b3-bab3-4bd1e92e9c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.180.139.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11ad900a-ea83-4782-88a1-666c671f0c79", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.22.201.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa6be721-c7b0-4f82-a2a5-21459653d7aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.3.154.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6058f86-1b85-4596-9514-77964ec2293d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.96.136.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3f2d0c2-f372-4530-a0f7-232e03b20004", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.98.148.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac53495-d3b4-4376-af00-804380eb5b08", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.12.109.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27951cc6-b90a-41e7-a728-2a11c1921232", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.16.200.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23ce6881-455e-4d59-b9d0-78ed56af029c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.16.204.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1440cba-6a6d-4b76-852b-f84ff5ffcfeb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.163.139.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a65e73c-ed14-475d-ae4c-bfbaf54e9c48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.181.32.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3d9db1d-9dcd-4b95-b12f-f7b860600a3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.182.112.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f93820a-5c3e-4122-9934-9e4e39292c5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '60.191.125.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1407ce-5b1a-4f8c-9d6d-95a4d3ab1432", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.169.202.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3494d34-ef62-4ff7-9382-e367c796c6e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.178.24.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f96d3438-ff37-4120-a3d9-97b07dd1a72d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.222.55.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b644d620-4765-4630-beb0-aa6fe7e74351", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.54.6.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec99a037-d2f5-456b-80a5-95989e4b5676", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.75.213.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8be9915-632b-4bae-a64e-00010d9cb882", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.95.140.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46d56ac0-d26e-42a0-bed1-8559874e56b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.132.18.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d68e3d7-5a06-46db-9c09-d769c7e350e0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.173.38.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c81fff-aa43-45dd-a26c-4d6dc79d3823", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.189.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c0467f5-fd2e-4b88-bdf0-a5a72d3d509e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.199.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--603fa7bb-4dc6-4865-971f-29a544f27d0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.209.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1657230a-b096-41ec-a936-11672be05f0a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.210.38.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d9dfb9-9262-4615-8836-893e0d323075", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--785d06be-80ea-4800-a635-0e085a614a14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--397e4df8-7b5a-49f3-bda8-06750a536787", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.177.112.161']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08095e47-afa8-4d07-b14a-770bee161e1e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.7.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7c4bde9-b001-4147-b2b2-090d9d7c3de2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.125.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d28a3c6-fd8b-4399-8e54-4d72a630a345", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.226.93.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30e1cc29-93f2-4e3c-9891-1378a958ecb0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.146.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf69aa7-dc7a-4d2b-bd95-d5f976d57fef", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.49.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da80bdd9-48a6-4710-ab19-df09866b9f20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.76.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4362d435-a1ad-4494-9c1e-cadfa3c0d330", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.23.237.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d4e601a-0d1e-4c18-bbe5-83f24f87f057", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--720128e4-8401-448b-a62b-5049b98c3e72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f37619-8f9b-4f78-b249-eee459d54538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21ae3b71-4798-449e-8a91-ba3c3f32a240", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--866f23b8-9feb-4b63-9108-1693d32453c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6975c56d-1744-4605-afb9-aa2a66df90ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c491696-dd88-4809-88b0-0f90b9629509", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2c4c7af-348c-4a84-9475-4dcf2dd82161", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--905af4a0-b4da-436f-b1a7-d6d3ace1166c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f116bd36-8036-4c84-994e-fc35213c75de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce56314-ea67-4530-8f0d-ce5f612eaa18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe64177b-3448-4b44-81a5-d706862b2872", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d698e2ac-ffe5-4753-aa82-a5c390caff45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.140']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf1d95a0-5845-4491-b679-f1e7e8d3d4fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f1f91d6-acea-42b8-94d9-b8c2e47583ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9bf59b6-4863-40bf-9183-deff9586c141", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ed01d3a-ea3b-431e-a1d0-57c729f4f5b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3be8caac-42bb-463b-a31b-7a43c23b52d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33a23dee-2f43-4a11-87cd-60a21af6eb1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666e6eee-f5ca-4804-9e22-06eb2216bda6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5bda2c8-e20c-4378-8a38-ce079164065a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22713847-afad-49f7-9935-8b70d999598f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e1afd06-89ed-4887-ac38-c477916fbfc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ae8200a-07b3-4097-98ec-7e8433176b5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79e31163-a426-44cf-8c2d-0e30ffe2f348", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ece1bd0b-4fd5-4d39-a845-b66ea7b68bb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88a33604-25b8-4622-8d9e-d41736236dc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7931382-1b45-49c1-ab4d-dd7c419b0d57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12757617-d683-47e7-8ef1-2e21a418195d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71459f02-a6ff-4963-afae-1a368f1b4d51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f35f551e-2d21-41f1-86c5-a5f6d4b7f4a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fc78434-77c0-43f2-886f-54ccaa84b5d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3756e37-68a6-4ed3-bb2d-1347a1d3c982", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc8e97d7-45c5-42be-b34e-18e9f8da33ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7082fa86-7519-4aa4-b497-ed044b288816", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c42b7904-0196-4c47-a2a9-4bc09745b1cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27d014d-8990-4994-8006-b0d3cc622979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--473f662e-6374-4db4-80c4-cfe7a6971c90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0db8f687-875a-4e65-8d81-2956071423e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e91550c-490b-4691-8ab2-e63fac80849c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a87138a-aee1-4344-8601-8e393f6785fa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74706b85-100d-463c-802b-971dc925361d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de66576e-288e-4a75-bc10-98bd678386e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38689fe9-de59-4b42-b4c6-05060d3eaa07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d6bd6b-39fe-4f18-88d0-5d18e5456d4b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f16fa3bb-a87d-4e0e-bf9f-712babb3d865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb55339a-74bd-48e2-a1e5-27486a6228e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2068d787-b62e-4ea5-86cf-75bc2e7aefcb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a0680fa-d90b-4db4-9935-62569b5285b6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--402cd15b-1c3c-4bfb-90bd-faf98454ef85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd2f1191-1c6a-4f54-93fd-e2b99452279d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5980da60-0ab2-4cbf-8ba9-69e3af65589f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a451d683-2480-4cad-8d13-00b48a1a8193", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a284d34d-bb81-4dfc-ad28-6b5000f48072", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b12c61e3-b3b9-40bc-a08f-bc076ace4428", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a7bd6e7-004d-4f3f-8eef-f6a9f73cfe5f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c7da8c-5b7d-4f4e-9942-b18889c6af18", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--020de442-1c86-4a3e-8440-b73e69f5b0ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1813322c-ab9b-4d04-9b79-f3e78493a6e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58675c7e-4270-4bc1-8651-6e6024745a4e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1acf9cb4-b726-45fa-b876-affe62d1e7ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.156.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa77d01e-4210-4e61-9ef1-6389b8aa73f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95c8238b-e33c-4485-ab0d-0bad2fcc1fbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ab5753d-af1e-49bb-a88e-7700a84c4190", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--500e7c8f-3db9-4ceb-8c90-ce726a58cd31", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78e8f0e6-b724-4551-8fa0-f869d6ed5a4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--337b300e-703c-47e2-b481-6a3bfa70800e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13bd55e8-dd1c-486e-99ba-fd3a028f7f46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02c4a6c8-ca41-4a1c-b148-3571a4957538", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dce50abd-4139-4d05-8f58-bb7c8755b100", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aef3d773-819d-462d-93eb-80d5229b9ad7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--689a7f27-3cee-44c0-92bb-efbf0b9c0e41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30ada8a5-2839-400b-9b95-11eb2ae915a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--303c5480-2461-4a10-ad30-66bffe2e325a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf3761f-3183-4e01-96b3-9fb44c4ab9f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cddcc486-d8c8-4c49-887e-235f478e1813", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd19ff3-0d87-4512-a876-d6e7dce4494f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0df19e3-8315-4d1d-96b2-cb2a0d60966e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6d31b17-42f7-4c45-a485-3ddefa022482", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76e43c1e-0492-4cd4-95c3-b9ab51067aa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f193861-34d7-4576-8672-77af109ee6ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf2d95fc-fbca-470a-a9a5-a7e03a27d28b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99e88e97-9c29-4614-b722-07b30a968aa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--973b4dec-25f1-4868-9f83-6ca78801a5cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dcec7ec-2624-451b-964e-7d934eb3be66", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7714de76-438a-4e39-9f63-6918e62da333", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57f68b4-6ef3-4db4-8f03-4502994820f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f71c1e62-d6aa-486d-86dc-8fb82c7c0f0b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac13a45e-e40f-4a2a-8815-441ff194104d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7757f9ee-cebc-439e-b910-f9368acea53d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9ce646f-68ad-4650-864d-1c9070d035ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd823b0-1c9b-48ec-b803-179e77db8565", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f719dc-3e15-4a78-81b2-6713739e7caa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb59f01e-8ca3-4559-b761-255fe087a63d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6f0c611-e5d8-4ef3-b143-15bc522ab264", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9de62f2f-dd47-4ed4-866d-dcbeaf3dfe97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a920a6a5-b031-4f11-8ebd-752aff05a678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d159b07-9133-47cf-831e-fb7ad2e10f15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c86233-1d27-47ad-aade-c5b393930b4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7b94e45-0588-4989-9e06-705a2f9034f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e17bf82-278e-495f-bf4a-85ad8a71f708", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--716cd433-71fb-4984-9d4f-59a2d7e8e48c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd1c92f-b4e1-4124-b58d-fa835bb6a95e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e59bb53-94f1-463b-adb6-06e406b7bce2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdc8cf4a-4df5-47b5-b1d7-dad7affad6ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fdf7661-aecc-4e75-8196-d730b633cfb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac40b12c-e11b-4c6a-8b94-cb50da0dee26", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17e9cea9-74b5-473d-bc69-bc44960e1b1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b872785-032b-4b2f-81f0-569d861e103f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10bca74b-d9c9-45be-a08d-8aaf1e6130c7", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e072c74-2229-43eb-a277-ab5744a63386", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e27daa-6e2f-4dee-a815-7c84aa214010", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58c2f2e8-3b0a-49b3-a6a2-c4dba3245e16", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40e30f6f-573f-4f6b-8fee-8627b7982973", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19e1ca2c-e5d9-4caf-ba29-11e85549c13c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb73fa1c-e67e-4927-bd5f-5e71d6947ceb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--853dffbe-6851-41e9-9aa5-36fd157d0fee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28c876f1-a251-4a63-a9ce-e60d15817ca8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a04e4cf7-39c0-43b9-8ecb-c534dc241b24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8efeb5d4-bba4-49ff-8bc0-79a424e7c569", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0831a76a-797f-4944-abed-daa400400d6d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.76']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d55c56e-34da-4021-b067-5edc7df3967b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56a04648-3dc1-461a-a7dd-ff8785179d89", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.80']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50cc0261-3d93-4494-bff7-4d59cddc6bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79219928-dbb9-4d30-a307-722e95345091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--703e2f48-3824-413a-b5bb-e5a35671c132", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.62.197.99']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aac7353-2b33-4e6b-bccf-57a4e1910a01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.162.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05510af5-0a99-402c-b6b2-45c7fc42ea15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73b279ec-db1a-49d0-a009-2bb700f16ffc", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89827c2b-da47-4f4b-b226-a362e255fb65", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--107802a1-dae6-426f-bafe-e9b17e250de5", "name": "Malicious Host", "description": "Observed: MYSQL, PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:mysql", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b15efcf-fba4-403d-aa67-39affc92ccc8", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45081979-c7f5-4393-97d1-2432e9caec3f", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc5f82e2-14e8-49ca-8989-d39218405ad6", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4e83c7d-ceb9-4b02-8eac-046f78101f81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a25168ef-5dcd-4ce2-b7a8-0111c9d63d08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebf12ae7-1d94-488d-a692-e5d2b62f1611", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.180']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94938028-af14-4625-9e37-95729ad1a1ea", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a573e65a-2566-4e72-baf9-cb4b3759f013", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b31e226-3d84-4e4a-bdc6-797ce008b247", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90a74f19-96ed-45c8-aa92-f70cecd3ded6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7509be5f-e818-4065-9fe6-b381bf8586ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91b7dd1c-8f71-4651-bca9-d141f787dd51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab00000-5296-4efe-ae99-19cfaf626943", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55b70329-61fb-4f2b-abdd-3cc1be4d2547", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07e9a28-54a6-46e9-b9dd-bdb6ddc783f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941ba36b-42be-4c11-b9a6-d2900031b149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48fdced4-4485-4f47-bb6a-2cb7aa61035a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e3c4e9e-27c0-4810-b740-fba81e4ade54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d391f36-0ffa-482e-88db-1c0986678284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da8a9cae-4d14-4fff-9fc8-e097f474626c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e488efa-36b3-48cf-94cb-36a41223cd4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168165c7-e716-409a-b008-a35e9372717b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93c9037e-fe15-4606-8314-9e4bc9ebc5a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e38b5d7d-c5a8-4028-947c-5416fca980d5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--873107aa-719c-4605-8405-4f979f08c2df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fd0a8e0-6b1a-4072-80a5-f5fddbf4af54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be15b0d2-8f69-41a6-a69a-aa7acf7417a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab8f2132-b1df-4e5c-83a8-c98f5ce37b2a", "name": "Malicious Host", "description": "Observed: PORTSCAN, TELNET activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c03010bd-1d4f-4bb4-a4f8-1b8345788c51", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03ede66d-d152-4dec-9da3-e74ca572f807", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93363fb5-0ed5-424a-ae05-278add4c055c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d33a86d8-12d9-482c-bcde-adff0c8b6cd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0151b8f1-997e-4242-946a-95052493aeec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--485e81f4-261e-4cbd-9e9b-7202e7610fcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6322f361-865a-4e63-8e07-7947bee3aecf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d251d224-a0fd-4a8f-866d-2fb7ffc59865", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41bb9c7b-fd70-4edb-b670-133a552a2452", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf03510-16d7-4278-91ab-db8d90e854f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.172']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a9f055a-51a4-4ade-af9a-3677b59b4c19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7511dcd0-a245-43de-a934-848513443f37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4e01074-97e2-4408-bc3b-3c670b35c8f3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce7fab1e-3dce-45a7-8b44-99c88e55f284", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5534af2b-82ee-48eb-8e4e-4a67842423bd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.188']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeb45836-1251-465e-812d-91680f9ac502", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137d3483-895b-4b26-9dba-c1e185166595", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c09f7c9-98a3-4865-a40e-6662d8d8857c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de8eca1a-036b-4dbb-a6fe-e017f68396fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8fc101e-3eaa-45af-8aab-2991b9d35e73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5fbad9-6145-4926-bccb-da13a08d6763", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c94b8a8-8fa2-43bb-b011-dce295f939ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c00b3e0-2eb9-46b5-a59a-b2b47111e457", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--673025b2-cc8b-4eb3-b0ce-e0d97bcf3166", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae189a66-ec41-4ab8-9ffb-c9c79b5093f1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57da38b2-4a6d-4f95-8922-8fcae027adee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23c0d3ac-4560-4a72-a72a-e350834f8c5d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa3368ff-4b14-4bc6-9fb5-51131cba811c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0de30a71-357b-4ffc-98c7-84a150e2fe9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8932ac3e-77c6-4f2a-9a45-afdac5bfd239", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5f9324f-e47b-44a0-810c-2715cd1696e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d2d5d2-dfa6-4bbb-9c64-ad752c89fb7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacf0fdf-1d56-4085-9234-047ba650d388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6792ff3-e68e-413c-90ca-6f561bfed6ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d905a6e4-fb0e-491c-a525-e2fb98b9e7d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc5b3448-0a5c-4818-aa12-9128bf2a77a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e33a7c-31f4-48af-85fa-204609140895", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db916da-b36e-4f37-ae14-d8b446b120be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--168eaf06-391f-4194-9f01-9d3cff6fb5d6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34e83b9e-83f2-434c-b24c-6e82ccaa47a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96b1718a-22ab-4939-a3a7-698d075cefdf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--719e0647-2f67-4ae0-a73a-6ad49df77216", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec96a072-3e6c-4c90-b09a-0210e1357552", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf36277-0217-42ed-8db3-52d1f6498c10", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0b69f86-cde9-4efb-af28-b4dda7474128", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aa356a8-e408-4329-96e5-d647f58b7115", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4632dc06-e1c7-4f61-abf6-4c6f975f33e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060fc67f-5095-4aa2-88d7-af89c368e313", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93dd9e0e-0642-4488-a42d-b95b171a8f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a19b0b84-639a-49be-8932-7fbac5aa550e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4eb48c83-4c43-4119-ae33-76bd10281199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a3c2c54-6e7f-4238-9047-5f079a246fa4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33868f9a-9396-4ce0-87a6-8008c190cdca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c3813d2-a5ae-4e56-8f92-108d10558745", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95cccb17-c06d-497d-867e-53872875dbd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.1.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6f3f6d-bf43-4a49-9aea-e5fb5d72774c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f6771a9-7358-4638-b53a-03cb365c72f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c88f642b-5d64-429f-a4cc-ee0a92c9f2a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09609114-b1c6-488c-9cf2-98b800ad0ac3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64775ee4-7169-4639-a870-239aa93b467d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81efcd26-e819-4f35-b22a-df1789d0a975", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2774c64-2f96-432e-b961-14a90896a86a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2c29f5d-ff1e-43c4-97ad-c377f4c430b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f789605d-269d-4c4d-b6f8-7ba82aa88420", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d53f3130-a2ed-4377-92ce-94ba208ea678", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74517879-5f02-4f06-9e56-5584a8775b28", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.49.20.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a798edc-11be-4a51-a1e9-63c4ffd4f251", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de27111e-1f73-4034-ab9f-a22558af7647", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1309423-a3af-4dcb-9022-dc9627c3d999", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ee18af4-9493-4de0-ac0b-3c9752660199", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5293a9e-8590-4929-a80e-3ba56cd320ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63f25ceb-6b52-4902-a0e8-77faeb31e6c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--714d30d1-8aa9-4215-98dc-3afd6d5ac149", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--362cdcab-376e-476d-9b19-a8aa25c7e877", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--941f91fd-bc2a-4b81-bd72-2a57271bdb13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af7da80a-4ab0-42bc-a4bf-11555e42a70d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11596ae1-803b-4a99-b694-477afe189a04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e23c5011-1cc4-48ad-b817-91749b38dcf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3866d406-b92c-4468-b15a-232bb1a3a627", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df37f5d-7ca3-4110-8252-139bf8215352", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef98a6c-4910-47a1-a4fa-523aa0c23133", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.132']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c59a15aa-8e76-4253-81c4-e922aef3a018", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98bedd1f-8465-4339-85cd-ad4d94e81ef2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ff926ba-6726-4145-8aef-10710c0748da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb5314bb-4484-4714-9ed2-8143334dde06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0a3ab1-26c5-4324-bca5-d918369fce39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c70a38e9-5590-4c02-8972-4acbc1005e9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa27742-564e-4d03-aa59-80be671ace44", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c05932c0-7b38-47e5-b8c7-9cb92b3dad04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--437cf1de-0dc0-4c06-82e5-338f8250515a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2af50c34-db01-49ae-946e-0d5b8e5caf96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--324d4767-dee7-484c-a7fd-ca0daf351a43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71b59c2c-3050-4e69-aeaf-a2ccd0c16196", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240589d5-fb28-4993-9574-3d51eb0bce64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--984244da-2a24-4afe-af11-539fa00a92f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd48a5b-39ed-432c-835e-98c0f13e71e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af829fa2-2dd7-4cf4-aec6-1951437bc593", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3bcb5ff-66c1-4b91-ae4b-c96040612b81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9d664ed-78c3-44f3-ac24-1692fb3f24aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7a2dfb-a1a9-4a17-9a1d-7ae0b726986d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a224c280-6a92-4103-87d4-bbf612fcfc3c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41ffde3f-ee00-494e-a724-89c874701d55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--768c9eb4-cc79-43eb-8237-a40646d55ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8559f7a9-b82b-4fef-8ba5-aa2956fb70a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0e5887-cb8c-4c81-9a58-6993c0fda54e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d4af34-c30f-41c8-871c-e0f090f3bd08", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebfac1f7-48f1-4dd4-8e4c-4254c933ba6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b24223c-aa6d-4d00-bfd3-408f6ce616f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02940cdb-3153-46eb-a008-8fe11a34d9d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4501f711-ae64-49ec-8e73-960665d1b831", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e22494-77ed-4fc4-934d-4599e42cf7b4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b7142a1-7b41-40a7-8a1e-ed342bb227e8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6673d396-7b26-4f1a-b223-e3710a6a9cf7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fcc400a-c786-49cb-b4f0-5e88d6ac6afb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.238']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4b7a084-937a-4fc7-a3b7-d8d849333cf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf4da0ab-1ea6-487a-9f5b-de9fcb39014e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a47192d8-0bbf-4a3b-a940-1be79d155d96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a79c3c31-fe8e-47b6-9614-436a6beef6f6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb69c70-ab23-47d2-ab76-caeba7cc63f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.172.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eef9714-7dea-4097-9c4b-6bd218a15e92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686974ea-9d70-4bce-ba6f-59a0fefc10bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25242761-7df8-4d4c-8460-82734aef6079", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58696bb8-bc90-47bd-bfe1-4fda0bf403b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ffdcd58-e8cb-40ce-b4ac-f2ba6e869c97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1084552a-0bd7-40d3-8198-a36136d503d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cf7753f-090d-4152-b471-a212734d59ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fda10eba-86af-44cc-9ddb-210c02f85481", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ddeeb6-8d7c-41d6-bb4d-b9b5151a4978", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b89a3725-1580-4ace-aa00-857311258b3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23496427-ba7a-4341-a0cf-109071279e27", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0300c8e2-2ab4-4e62-af31-bae819580686", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb9272fe-5741-4ad1-9bc2-d630e7fd2159", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4383d8e-6ebc-4432-af22-8179585e9e52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3aef389c-ad45-403f-ac34-982307876400", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d763ea6-98e9-4657-8211-bd000e7dd69e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--127c0989-58c2-401f-8c45-42ac0165ee40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--697982b6-bcb0-42c2-8dc4-395183633a6f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a11585-df32-4e44-b0bd-9db9afcef15e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c7f5c8d-a412-43f0-9507-6e3a478f8825", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b68f57f4-6d88-4ada-8934-b262f0a8b337", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ab097db-5fec-4f9b-9b30-6d9e72e2c383", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a41b3d-e97a-40ef-834c-f992f377cb43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9de77d6-80ac-4676-a728-b968da69d377", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d41092b-f6ba-40d5-887f-8263583b547d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ddc179e-1b55-429b-8b10-088b7e960afa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1d3cf3-ce43-4422-a33f-f736d9c204b1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9104e90-b221-4909-b978-61e9482df799", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae8a23ce-68fb-406a-a1fa-7ac1d44530c4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.220']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96666bd6-67d8-453f-adc7-807492d747c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6fce3de3-a347-4f02-9980-3a6d7a549a3d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.222']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea420fc-e623-413c-8d49-7a84b7cdc446", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e17422f5-7850-4046-a0d0-e11f7cd660ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--423d183a-6be2-48e2-9c66-9bea6b5dd79a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--285740a4-4b04-45f5-922f-7a7fa3369814", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60885598-1056-4f9c-b3af-f1ce5a738878", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4192fe8b-84de-46e2-a594-67e59522ff40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd1a6d1e-4a49-475c-bd3a-4755542cb059", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12f12d06-feed-4f0a-bf6e-950c419f54d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b96b7a5-85e8-43ed-a002-1014c6c790ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.234']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14fe951a-70de-429b-986b-2dbd5828a097", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d6a285-d5a1-48fc-bf7a-379c6b290f4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68498583-774e-47ad-9c78-03901de6cfaf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e07efdbc-afe7-4f54-8fb2-cd707bf1b02b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2521f5da-fe07-4d20-8b44-5961944b7435", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80792e05-f63b-4fb4-8f19-f2a7ccd11e02", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d44511b-700a-4a0e-b9dc-9332d9036cce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7817997-695d-411e-a529-39a5cc6b455a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.244']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c7d30df-fe2b-4070-9700-2e7393bdbf70", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--269a7986-3433-4ac2-9d00-4e0ee3238356", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.246']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c497a0ea-f7f1-4cac-b7be-905ceec76601", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73eb1bf3-069f-472d-b76f-bafb91d90bb2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a67e011-51ed-4e6e-b4f7-2df47f182ae9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a57b8c2-e85c-475c-b4fe-584f521ae6b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe2bbc6-fdb0-4e48-93a0-2e2fca73c388", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534d4340-1ae7-41e4-bfbc-9cb42d259402", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.252']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ad17152-2155-4f1e-8963-77011b835235", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2876aa-5faf-42bf-bff9-b555ac8dcd9a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.186.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6503b023-2b36-4aa0-87d4-2324b8d10626", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--357a8b68-189f-4e74-99ab-ff091ad7e60c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daaded79-38b0-4c65-a80b-375163585736", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e565cc4a-6f92-4be2-b2ee-35ac956372f7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d0e52cc-1bbd-4343-8aa9-357aeb810c30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.152']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93727b4b-200f-41ed-8c3d-73cf3af2a656", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ba309fd-75cc-4b7f-a38e-81bf041ad349", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9a1f5f0-0b85-4ea8-a878-04960525bb96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cab985f-cdf6-47ec-9302-a54a2cf42520", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28e484a1-d0f2-477d-b870-62351986d524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70386d24-074a-4949-8a5d-1af8f82aa7f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d6d0a9c-5b58-46e6-89be-621e94220b23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6885e73d-39af-4f07-a94e-187619f1cbd3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49864a4b-8026-49c8-b9ba-679abc439c81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c978b0-1c5c-432e-840c-5e34e8c605e0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--961a364b-2b17-4380-b0d4-6e710f72498f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c6276e0-7252-4adf-b30b-9b03635e4516", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d07799f-b068-43f9-8a13-037ef477d259", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b808f92-37f7-4f35-b686-117584b14524", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b09d84b-3fea-42b9-b2e8-6d970a725f19", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87f03afc-bfec-4b5c-b69d-53a9fca61f43", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.78']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74edbdd2-d71b-41e0-b07a-fce2f941fa49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.92']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--231bec0e-e3c8-494a-ba67-b094d9439934", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a54e2035-47fa-48eb-a3e2-3fa7ca98c976", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0923210a-7b94-4c79-b34d-8eae96f8b6a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6700af8-000b-40ab-a00d-515b473b20bc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a15c77de-e979-4725-badb-0e9ef2e2d992", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77a668ae-aa8a-44f2-aacd-f0e9786eb5ec", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e6d5f77-edb9-4a67-be48-84b6349aee0f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d49c2715-fdf3-44bb-8911-659383ec2541", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c685214f-8a26-46c4-903e-2a6f219eda11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa920cf6-d512-49ee-a553-1d2c37656aa7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a17bafc-d7bd-4950-a350-fc38972130a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33cf64a0-3c57-4617-bb1a-6a2287699c57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4eac156-a7be-40b6-883e-5b06ec329bfd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90b264d3-db5c-4665-8ed3-be0a010cd519", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac148ac4-ea14-4f0f-a09c-12c934b30209", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0c1ad84-e0bb-4a7e-b94f-61513c33e1db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3b647ad-9667-4a84-bab2-845fbdd9ebce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2254071-7d62-42a1-a456-70f0a87b5f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d5cf4f4-bd57-4013-87cc-72521fa4e73b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28077a75-16e9-4605-bb1e-009fae6a63c7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.224.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0811b1fe-3bab-4bf3-a463-6da6226c8319", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.167.166.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10e8ac2b-59db-46ec-a5ea-90a3cf7a4b58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.212.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7413426-e71b-4083-88e0-96f74e96cdef", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.175.220.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d827f1d-8155-4966-8c77-59d9abcd0f64", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4fab8a6-4563-4bdb-82ba-d9e6ee7fb358", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.40.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bb72af8-0b88-4e45-bd36-86d7dbab92fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.41.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--155ba809-e9e5-4b60-88e5-bb2216c7eba9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e69840e-62f7-4cce-bfca-21fdb075454c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b93aa1c5-bcd2-4730-a8af-f7b4ae1cc193", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.228.53.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c68660bf-95f8-4d12-8901-222d6ddcc9c5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.23.115.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--437896e2-79d5-479a-8a54-3eca7f0cb649", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.192.82']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb377532-ad40-4343-9e26-b83807c66edb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.205.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b3e844a-20c2-4c81-87fc-0a3bf7a158c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.219.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6706ce-92a5-4ba6-89d1-e28a266f30d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.223.240']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9a74d77-8a0c-4cb2-b513-8c507262cc73", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29381691-7106-4077-940c-f8d9197cbb33", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.116']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a548a3-2b72-40e7-b94c-8d0c2f9b4d17", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.240.236.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b16f14c-14fc-4c37-8c1c-d4cd11ea3325", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.72.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--136c7270-2211-4fc5-bb46-dc0359bb8418", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.72.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3058c12-c9ab-4de5-ad84-c3ef776f38fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.72.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f7eb857-1da1-4e2e-80aa-0f5ae1f92357", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.77.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6f9d8cd-1155-4640-bd88-b79c032500e9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '67.205.160.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcca25b8-6c00-4b05-89cf-ebf2bc5fda6b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.193.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51e583d1-14ca-43ad-b165-0daabf0b040a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.193.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcea0eb7-6cd9-4c57-be4b-34df9adf4145", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.183.229.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e8425f7-b76e-454b-ac7c-79d90f6b041e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.69.177.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2b67d13-7bad-4503-89fb-606f4bc78af6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '68.69.177.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1070b26c-e5f2-438f-8dd3-6e056fada5a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.135.40.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e04acbb1-e96c-4ebb-8d0e-77a85ec76f79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.214.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9fd7a1b-a3bf-4fd4-a5b0-a26f96f98404", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.164.217.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b28a05c4-01e7-4fc4-8c13-2127cbbf7cdb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.175.92.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a5133e9-63ef-4e76-aca0-8dabb69b3271", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.54.182.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95d4a36a-736b-40e2-82b3-e7e679da4772", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87bd88bd-26fe-4f19-bcfc-3e624e6999fd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.232']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50fb65e2-c3aa-4275-8420-29e59d86cc25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58eeea9a-e024-4f08-bbe5-706465b9758c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.134.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3ff854f-d1cf-430a-b397-a1df4130e0a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f1a8962-ac04-4758-afbf-b063cebf9091", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.147.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cd465f6-4238-40b5-b894-97b16337b27d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.158.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0916688-5245-44a8-8456-906726c0a78a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.165.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dda878a-3864-4f90-98d4-3ea81b596713", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c73a984-e49c-405e-8bc2-06fc0c1de8e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b72f181-13f9-4c46-9487-c8434d6ff92f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.199.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1288330-9cb2-4d14-8272-212bb3c5cd06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a27ad36c-5afc-4690-ab13-379296c1cd85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ca7c67a-7742-42c3-b9ad-42f0fae84857", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5646965-e5da-4aa0-8748-cf22350644e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e0c9077-e503-41ca-8fde-ae0112b757af", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e51363a5-4e42-4861-a72e-d6e14b32a91a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6a22cde-aa6a-4d86-806a-151f730ca0d2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.232.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5e23ea5-9e5d-4ef1-9f59-1504e418a31d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b62c722-5fc9-40f2-9b1e-73f1abfe8529", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d861cff9-7174-40e6-be22-7093545ae281", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.192']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c2b1584-b0aa-492e-8d6d-2fd8b6e12dff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4bca4ec-c28f-42dc-a466-e48e0115c231", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c132b9e1-40d6-4c4e-b6ac-91467af97460", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--901b0dd1-730f-4a67-b618-566f56d7d984", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0dcdbf06-1359-4b0a-804c-c50ac3522e94", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf83a35f-0a68-4974-8077-8893bb20924e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.6.233.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe498f8-af74-418f-bda9-8f592d25b7fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.14.178.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71ec6091-4741-4dac-87ee-d62e5bca928d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.14.186.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ae12fc6-79c8-41b7-b12f-8fa91c919c1c", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.252.181.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b77e3f-329b-42e8-b993-e7fec2a25470", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.253.251.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea2e5fe0-6746-4b5a-86c6-6b08d013d0b3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.255.18.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--707d7a4e-fb26-4b7e-b672-9b2150c41a43", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.47.208.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bdd476f-5a8b-4620-bd58-37b574c838bd", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '72.69.72.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f00a42d3-98a1-4873-8cd4-98732e602cf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.158.135.104']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d257473-dfba-4b2c-ab9d-44073e902bcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '73.209.247.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8048546-b2ca-4106-9c7a-cfd47e00a16c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59723693-32bd-4241-83b7-6a9fa5f3673e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.207.253.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--907b83bf-fd66-4dac-aff1-44e773652221", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.130']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce2cad11-3d43-416a-a3f7-712ae3368b2d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.100.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d59be09-2a1f-4f10-84ad-8043d1553980", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.104.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7e9fb04-facc-4767-9ace-73b3885e4acf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.235.185.122']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec45e694-5917-4599-82a2-b8e48f61af83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.147.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3fd3a7-43c0-43b8-8cb3-6bfb99f9603a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.177.184']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7196acb5-c9bd-402f-9e13-351659231aa1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af14caa0-512c-40c9-a4a1-3b89e3d38ea2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.178.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9191ed9-2603-494d-bb16-f27a2f550d4a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.249.192.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6b5526c-78d2-47e7-904d-c8e1c7f332fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.148']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--553bc1eb-8d11-4074-b70c-b7fd4a818c9a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e615267-af6e-44b0-859f-0e892e26be6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.244.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7556cf23-6101-4fdf-8a38-1c868c5de67e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--162c0dbb-b308-4600-8954-e19d31752c0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d8fb307-0dde-4a18-9e9b-4842c2fbd870", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccaf3542-5afd-48a3-8b6c-2e578de4056a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f52227b-f4c6-4696-a2b7-794cd03afb38", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4176fd8-76d8-47ef-913e-8aaa6d5bd1ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9270996c-4e64-475a-9e5e-efe35efd5ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffda1086-da84-4537-a21b-c62a9ac63cf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e37cb975-5f7c-468e-9801-a6b280b24b15", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a9f4a27-8fdf-4a14-b83a-ecc43695bd06", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fa2b0a7-8d25-4da1-b013-cffc5b6b89ab", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f25f5a90-22e4-4bfb-9d03-51a5002eee00", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b522554-b5cf-49e1-b36a-34cf8312fc53", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68f2cebc-5153-40c9-ad97-31859e23a378", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32f319d3-cefe-4e2b-84ae-b09acaaea020", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356be926-3fc7-4f7e-8c61-a8ea6a74e2af", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40162892-9228-425b-bb8b-b6a614d74f47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0700925b-e23b-4c7e-9e38-79d0a38a1832", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.82.47.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d0eee5c-5c25-4a2f-aff9-d80ef8ea8a96", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.101.194.144']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--278b653e-80b5-4d31-9e52-ad798bb1c9aa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '76.127.61.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1709c4dc-57d5-4c3f-bcfa-a03b02ce750a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.222.54.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eda1d388-7c12-4d7a-bb7c-f34a3d4a1e2c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.27.140.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf7a1d1-a043-4d0f-94a3-24a7b3118f8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.31.55.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8154220-58f0-451f-9774-30a1e6d5a23a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35abe7a0-6f2f-420c-9fa2-d43b4e359ba6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca37e723-8ad5-4012-84dd-55401c60999b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.83.39.94']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4122a2d6-7ded-4d60-87d9-35465392749b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4403989-7de3-4518-b2cc-af5e4040e46a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92fc3682-a70f-44ab-b497-d90961ccdfc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.90.185.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9b6671e-b506-4bdb-b438-838c0749e393", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9815de0-fb1c-4bd3-bc86-a594c7667d8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df21fa24-66b8-4060-b49d-0dfab9258f25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.162']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e382c2-b48f-41b4-9618-b260e2c39e8f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.242']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d38991b1-20f4-4e19-bfe4-85943db5b455", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.111.67.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f70704b-7f5c-43d0-9eed-e94c4dc591d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.120.132.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15eb5c0e-89ba-4aab-8e4c-72aa4e3d7d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c55e80c8-3f3c-4792-995b-c38270a8aead", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.112.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc848aa3-350e-4e15-9d39-c9a6de379b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46f33760-fdd3-4baf-9906-45af1f714714", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4e64a5-f1b9-4eff-aa6b-248368ef24a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.113.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2af320d-2dc2-4e13-ab9c-4728227c6b93", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.102']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7462a8c0-0746-48ad-a31f-35fc79d4824a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d899d266-ace9-4a66-abee-f9ee1054ba13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9900f6-f6c4-4ec9-b676-788cd407d994", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.128.114.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6809489-fc8d-4938-8417-3d0b82c11f0a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.159.131.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55fcfa09-61df-4d95-8868-ff48c49b42b0", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.44.192.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0649982d-31bc-4b89-bc7d-1af7dc94b5cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.47.4.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e7051f5-916c-421b-891d-ddbd5aa0ff29", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.110']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62529942-ddf7-465c-8cb3-b7df27b03c98", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. CVEs: CVE-2021-26855. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.40.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--11c28ecb-752a-4e7d-94f4-548c43254b07", "relationship_type": "indicates", "source_ref": "indicator--62529942-ddf7-465c-8cb3-b7df27b03c98", "target_ref": "vulnerability--a6c040ac-6f84-4fdb-8d15-d4cc1d790d41", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e705fbd0-acc8-44f4-8c22-9c23ddc6beaa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaec56cb-17dc-407f-afdc-b2e2a2f8c154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.49.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--590b0cad-c5f5-4148-a698-84d37ad8888b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.56.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b47ef2b-aa98-42eb-821f-4735021449dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.58.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62339a0e-79c3-4a53-a8d5-8abcef859270", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.60.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc815f0d-c400-435a-b7bb-bf3ea031e3ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.126']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50d2583-3632-4c05-860e-a04eff90ecf3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.134']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067875d4-6706-401f-b606-623db527ae20", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2110d13-4fb4-4376-b9fe-0d0c9cb64adb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.62.230']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d64afc55-104c-4c03-9f6f-cdc539a7cfba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.125.162.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58a3196a-28ba-4ed2-8b36-00a7ebcee899", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.143.30.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c543ffed-0af0-4cdf-81d2-27a2352c9c56", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.134.159.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eff15d3d-99df-4b4f-8aa3-680d3a939f7f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.136.223.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72149076-4097-48fd-866d-1e7f510a834c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.140.225.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8f75e27-c859-46fb-891b-a8e413ca5641", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.148.10.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62d61797-18a8-4c87-93c6-244baaefc980", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.160.176.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--299533da-f888-44f7-ab4b-4bb5cb9fa39e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.100.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3dd6915-9048-421a-8f12-eedd0486501a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.107.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28ca0c41-fd8c-4ccc-b772-b0ec23e9dd47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.116.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e62fe6b-442a-49ba-ba69-2a750feb24cc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.126.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca098cb3-8a2e-4a6e-aa77-ad0014a7572a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.231.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--555bff97-95a1-4f12-92b4-58d170750990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.236.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d1790ef-bdfb-4299-acda-54bd3ce6f0a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.236.84']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450dca6e-e2ff-458b-9619-bf74fd50e31f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.254.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01df6d7c-eaee-4735-b256-7afca5027039", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.74.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd644306-1a91-4c40-9cbc-53a71d12e36a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.209.75.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c34070b-1df4-4f07-96e0-6fb3c7f4410b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.12.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--235ebeb4-81ee-4f88-b1b7-780c5fdd1e24", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.27.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cac3ef74-1f5b-46c0-b152-2747adc24c46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.28.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63eddf92-43c4-41b0-a766-b25cb5c76751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.39.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a170cff-00fb-417d-8705-cbcf7a409751", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.42.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3008485e-46d8-450b-bab0-efeaf685f4ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.43.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c01d4c3-f323-497e-a02c-4dfdf03e082a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.44.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69bee908-7fd8-4321-8967-10e1ea87156e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.44.86']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87caa76d-cbb2-4f00-804f-2e48ee1ca76c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.45.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6379006e-92a0-4e14-b379-63d96d380a14", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.211.46.182']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d8f09c-ed26-4cd8-a0b7-24b96c8c6f37", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.0.100']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a17f676b-b6bd-4921-b52e-c26bcdedad5c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.0.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f34b3fa-6ea5-435d-bf02-4f25b7f6e4df", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.10.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8de572-241c-4b12-8a72-e9a10972fbc4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.10.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc927ca8-c9b9-4041-820d-0ca31f619ff2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.13.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ccc8f67-ea71-42a0-bbb5-dbde1ea2b804", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.13.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e28b60e4-d9c7-4ca2-9979-fdd544610cf2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.15.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--329c3341-1c51-4026-83a9-124a02a193fe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0d8de81-cbbe-4beb-bab4-3be75b560657", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.16.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--314d69ca-a78e-485f-9df3-be142c234b82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.17.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a40d76e-0876-4517-bd76-f6013bb10f77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.18.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6047c854-a501-4bfa-9373-f10b21c4eb67", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--691c4b1f-a5dd-42fa-812c-5ee6d3ac5dd4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--653ac985-ff6a-4d2b-bdbd-2c4b8024634c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.248']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bea658df-6fa9-4077-a87d-f6b3a89a94cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b738bac-0abe-452a-8630-29f425a4f156", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.3.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c71b357-8d8d-46b7-bc2e-47c282486ec4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--368d87aa-c5b1-4b86-8900-87f3a4b40453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b2ea891-42af-405b-8232-093b297f94da", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a0e918d-1717-4032-b53b-8f071da070d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.4.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d28fe9d4-9293-43d8-8f9c-d5ddab147220", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4dc14d11-46c7-4939-bde7-b48098a4974d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f31b4eea-c136-4f0a-bd53-6126acbf243c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc4652a0-70ac-47a2-8429-09ed1f646d45", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a65650-6116-4749-873a-be4e64984d4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59be663f-6631-449b-8cf1-b30f25e341cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.214']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--173e10fd-eb7c-48d3-89ca-f5982530fc13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.5.224']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdf567b2-adf6-4184-9a6e-3a52390d432c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.6.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d471e67-eaec-43ed-9a51-39442f140d2f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65869d1f-bb87-46df-a722-9e13cd7ad335", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1165bf21-d501-4cfa-9519-a03c132107d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a2b2071-045e-4997-b37a-b17e23e3e5d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.7.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57635d6c-746f-4692-b5e3-da6e91238bf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.84.254']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--add4b4e9-30be-49df-a57e-bd312a443dc7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.216.9.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9aa2013-9d97-4c6e-86e5-2d2116445801", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.218.169.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb5933ef-10b1-486d-a5c3-b2e7328d0181", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.122.226']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7929611-b4ba-44a5-9046-6a2ac8ac611d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.136.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ce654f4-cb2a-4feb-8cb4-a13607a2cabb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.2.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ea75d1-bc42-431d-93a9-c7f86cd8a517", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.219.222.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a2ba099-2650-4ddc-8f92-7ca250abe739", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.221.136.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeffc54a-326a-4bd7-8c5b-75085a703341", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.228.111.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa638b8f-9fea-48c4-bc4b-ba8e0ebdc162", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.229.172.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--515e10e3-5b2c-4e58-8136-dfd94525505b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.230.118.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--143a932e-7ce7-4d29-a62a-a67db2a0bf8d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.241.223.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94dd8b22-404a-4a13-a574-afe3666ec979", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.247.73.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81130dff-e104-433e-b3ae-40854b5c726a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.78.27.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b46000cf-7829-413c-9c02-b1a633a2af84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--997f6827-b3a3-447b-a727-f376e676588b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.70.228']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c137a3-8363-46e0-8707-5b6157c0b7d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bd29f5-623e-4abf-93a9-8c251838ddc5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.82.77.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1de04fa-d24a-45b9-8fa9-bcf87d97b5c9", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.164']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38ed1fd8-4913-432b-a6a5-accf98cb5653", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.165']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f11ae55f-0beb-471f-ad54-c45614786fc8", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e660bf4-1da3-44ac-b8c9-244bb9d14655", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f808885-9171-402a-bad2-6888a611891c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.168']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dd899f0-6933-487f-a514-0a305bd4b4a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--756bf504-d259-458c-8ec5-5c453338a55b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d738e354-e370-4ad8-8546-2adb2278356c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--459aa3e1-9496-4ccb-a7f6-6911371d6d2c", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.186']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--864a33ad-f080-4989-9792-d19653e0879a", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4e97e22-744d-42e6-9d30-82d30c425094", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.161.239.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b92efa1-1912-4051-9511-484dfcaee4fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.177.101.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c61a7f7-10da-4978-9d01-efbcc7c388e6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.182.185.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fb0e2d1-6645-4d9f-9e57-34e9e63ba4a5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.193.216.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--764b5bb5-cca5-4bc1-847f-aea14069ec7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.62.135.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16012ceb-8b27-4ef1-b8ee-28cf1d5f292e", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.152.132.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b831c788-f30d-4fdc-9baa-ac902638789a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.156.88.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9db6a0d9-77e6-4842-a856-d18c5413be73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.157.183.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2bb02e-d4c8-41b7-ba03-804dc1635aac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.157.235.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e21782b-c38d-4010-af67-b0a5748a09a3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.165.71.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--360de330-f639-4a31-a09b-72f6bad08e74", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.66.224.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1f96848-65a3-445d-9e30-8754f32e09c1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.209.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2242e35-ddb7-4264-973e-405080b68765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.46.107.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff9ba31c-e7a3-4a4d-b1cf-f863c5b7407e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.201.20.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b8905f6-f5ec-4008-9ed8-8a31af343965", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.54.3.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65c46c9a-7d0e-40a9-a37c-c1962105e6cc", "name": "Malicious Host", "description": "Observed: PORTSCAN, REDIS activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44af3542-7914-4d2b-b67a-cd8ea4fc9a57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb25202-ac9d-40a9-b2b7-ea37ae0a311e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--febd0eaf-62b8-47ce-ab6d-c3343206ecaa", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.172.88.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44c057a1-49ee-410a-82ca-da93bbb8d6e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c92cc49-ea8f-4b22-8ef0-27a898e500ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--deec25bd-812c-4fc5-a9d1-ff802e8110e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137f0801-1a4a-42b4-b205-d994ecc06c07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80d987b7-5541-4b90-ba2b-fea7c994b84f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5641a692-bba6-40e9-89a2-f3c59b6e9a16", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b0fe644-899d-48f7-80aa-9fa315fe15f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a380fe45-b38d-4d81-bef5-20c28d7cb095", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3c10da5-42c3-4874-bc79-4f77cc6f9c3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d007b960-9fdb-4992-9223-654f649046d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2f218b6-2359-4659-85fe-2ac519408428", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca96b8c-f9dd-4457-b091-e635ed321a4e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2744aeeb-4b7d-495e-862d-59c0c9c9e6fa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1b97ce-b356-48f6-a7e5-0642d6f4390f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b1b2750-8a86-4e50-97f7-776b8895c1cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6d29bea-1b42-448e-889a-b129a444ca21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a439422-4018-49c9-a4c4-fa6bd82e2318", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5721520-4815-4786-ace5-7e18c36dabc4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cc1aca3-1665-45f0-b46c-526264802333", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83fc01fa-0dd5-41b7-a3c6-ed6d1a8d0d08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--779cb795-a704-4f38-b747-767b3339b827", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49c725c0-ebe4-4abd-9880-472d3f5ea77e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b95325cb-1f95-4a93-a62c-aa65e663c4c5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea3da258-ff22-46cd-a6b5-bcebe75a420f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9f69428-0a11-40ef-8183-f7c350df5320", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c9faef3-11c5-44eb-8d65-a2a1e9104e51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c59d3f-9eac-44e5-91bd-6b24947b9700", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1f4425-ee16-44c8-a1e3-05dc42b8a2cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--964ee1d9-2bf3-487c-a228-09768a7e0c7f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42e65680-197f-4d61-89db-c4c6bbb894a5", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.140.4']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2e80921-14ee-4a44-b032-4be0db77d3f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.0']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64119b57-ad89-48bb-ba43-f1ea2b8c6e79", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cb22394-789a-4b9f-ad3a-1f878fbe83c3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--447bbce7-1b97-4bb0-a2e7-adb7449a21f0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e0ce351-ac6a-48c0-b477-d0bc973e391f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac93261-e7c2-44b5-a1e8-eb387a36b134", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a7276a4-b2be-4c3b-94bc-21e73561c84f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631eccad-e0aa-4651-b029-7bdac8fbaa97", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99e1010-8adf-47a0-bfec-e6d91d30aa99", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa87e41-8254-43f1-bff0-f52b7c7dc0cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cfa8aa5-57ea-4ec5-b674-47608c071e07", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.18']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7637c631-886f-403c-affc-ef4ffeb1e81b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6eb4671-abf6-4084-9234-b863b8493397", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.2']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0356bafc-f434-454e-88dc-2286f53ff4ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.20']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1774bfb-e78f-4055-bc89-7d6d8c4013b0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0041157b-7dde-4237-b3a5-063019e263cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e42470f-c4b4-44fa-8ca3-b0de540dfde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6888a863-4b4c-4c74-aeec-c59d7315936b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.24']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6d63300-8a3b-4866-b4d3-e89d5900acd6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa63c4f8-8520-4e64-8baa-cc32e88a7e57", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1621489f-42c2-4941-88e1-fa68c662d2ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.28']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c99e4189-e04b-4845-ac14-a3949851ac77", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97489361-7334-4209-b22a-d3737bc36535", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3292f30d-f7b1-4990-ae81-cb5196e241b9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7481ef4b-8959-42e6-a4b3-d59045880935", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2e933ad-7c4d-4bd8-aa87-eea68f16eb9e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68c7d1dd-6a3f-4589-88d8-3a0d8e1b54ed", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e04ca10-8075-476b-9cdb-ce87637c0f1f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e19b425-9265-45ef-ab5b-70f3a4f063db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fec2481-c4f1-40b0-a614-cad78c4241b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88c7c67-1abb-40c4-9f06-4ea4eeaccc30", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--422f6dfc-689a-4e8f-82e4-9166c8843c04", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23b8cf60-3e23-4b35-9c44-56e59d07c1bb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0cf19b1-a671-43fb-9ccd-b9ff44a43ec7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--135fccdc-2a42-4c6d-85a9-8adadf589f8b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d578b24f-53ff-4e08-9494-22c4377cefcf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b14f2eb-1a30-4d90-af25-bc69ded26def", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c14696b3-39aa-4c8c-99f5-b8cb808a3c49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.45']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1e0310-a3aa-4251-b636-a0faba23e0de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e18b7bfb-5adc-4bf9-a7fb-ccf78f53e3f9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.47']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f34f294-bdc2-49c7-a9eb-020970dfb393", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.48']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6725d1d6-5432-4307-a98e-b7e978fd23c6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.49']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac600790-21c5-41c3-865e-0b1618245fb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c1de0e4-cb3d-4bd9-b3d5-2430253c98ff", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.50']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c92551b8-f28a-4949-bb7b-25de0fd20338", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.51']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a1689d3-da58-4936-b456-e0b0e7451317", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aadf06d4-b302-4ffa-b9d7-8debe9e9fa9c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.53']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cdbae87-3a53-4cab-820a-3c9ce9b78d49", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.54']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0739aa5-f1f2-43ae-8a44-001a88f2bcda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.55']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ea9684c-d6d8-47f6-9aa5-c892e2103d4c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.56']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f5b36b-373c-4250-bb91-fbeb87841838", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.57']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64c9b081-abd8-4343-84d5-3fc95e11c9b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.58']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91df94d6-bd88-4f31-a3ec-5316d150d1e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.59']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dec430a-5e34-41ad-9b4c-49f50833eadb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.6']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--338b4e4b-9b00-4ee4-bfc7-fa72de1e5a81", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.60']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a7ba78-7450-437a-bef1-a365f3775d41", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a5c31b-8b49-405b-9e95-2a6f4eb78a84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bd26bc0-2e22-45c1-9b0e-5cd95dc63081", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.63']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a9957c0-7d8a-409c-830c-1bf537eb256e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cf8eb5a-f5a7-4fdb-bbab-19a64d34595b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ecc65a1-1830-40d3-b3ba-62d029913663", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.66']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35541a29-3e21-49cd-beef-dbab9b61d945", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d08711c3-01b4-4645-beea-c35a32cadf59", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.68']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6c6356b-1204-413d-9f2d-7faa0dc793c9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10355b48-83fd-4684-ba43-02c2825fb3f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcac31a1-9164-4208-86b3-59dc4fcbd1e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.70']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1419a21b-22fa-4182-ba5e-a637b5575e0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19d632a3-7c6f-4f89-9428-9dddef7a0bc2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.72']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df9ddc63-6d6c-453f-b550-8f5bdab438ae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b981663-92b3-482a-91ba-804a7c12d1cf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.74']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7cb213a-7898-4fa7-a9a6-8633d2c5bcde", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.8']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6cc5693-87ef-4571-90b7-c49a957b9a84", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f16ed7f-4a9c-4b55-ba2d-b9fd0f8a4ac0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.221.155.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e90a16d-ce0a-427d-a7db-d2ebc5afbbae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e522521b-e8bd-47c8-a1a3-eee4cb0a043f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.239.151.41']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80ad4bdb-d851-459b-a409-fd62baeff6b8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.90.246.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1add67-ade4-475b-b547-f9ceab92dd8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.106.74.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e2723bf-45ac-4cbf-9e96-550023ea0713", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.157.29.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b0a6657-393c-434d-8d7c-1ec8891d5f9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8976d281-8bed-42be-b7c6-89a4354d87b5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9c1918c-cef9-4a5b-91c9-e99ea2a64a4d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6f3170e-f663-4569-b1cf-654b4a446060", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.38']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6826ad69-a0e8-43f2-9d37-5b67ee1d5ee6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a243814-0546-4bc4-9400-4d05a2328dae", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.54.31.44']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a026f1bd-1e97-4504-ae4f-a2e41f26652d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb5e7305-b301-466e-8421-2f110faaf3bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.120.104.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ebe58a3b-9607-4ba0-93fa-dec8ceef07ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.69.138']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f19aed3-38d6-4cab-a9de-4203ec8116ba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.121.84.167']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53efa272-6cb2-450b-9456-f3b6c9060154", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.196.16.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--137264e0-ac36-4c9c-a6be-f0ffa3cfe3b2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.128']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf871cf-32e1-414e-995f-a2bba60edd7a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.236.176.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7bf8085-80f5-4cef-89d4-984020b01136", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0330c83-58fe-41dc-b50e-c76c6c853b09", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.156']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09985621-60c8-4934-b740-45e677ae95d8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e073a53-3c61-4fd2-bc16-18b765b315e3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.251.64.158']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1cb03ff-b5dc-4c3e-b625-3f3914d08d34", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.201.1.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bab3943c-4abf-4408-85cc-348a2ef3a7ff", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.205.172.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e98f383-a0a1-414b-9fca-09a3111fb63b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.210.63.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dfbebc0-863b-46b3-aaf3-4c650249b350", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.24.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf8bb9de-52b5-4e41-8e35-115c9e505f48", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.214.26.142']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--192f7650-db6d-454e-a9c4-fbadc62636a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.218.248.101']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4abd532-90bb-42fc-81da-af8e1a7d35b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.116.31.97']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--245b1d7f-2a52-4030-a20b-6809e2588532", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.145.166.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f219ff42-aba6-4409-a024-9182199038e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.43']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c21da455-0ac9-4c6f-b19d-7546855c208b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.190.156.62']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f291623c-34d8-41fd-b37a-6c1102a43bd2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.163.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dccd274-f081-4f83-9402-3f3c6b565da9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.167.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a730efc-b8dc-4148-89c0-a0ab560bd316", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.248.168.36']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--326b4d0b-51fa-453b-bbe3-0fb26bfad071", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.116.208']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa2aaa3-4329-4a02-8dc0-a70ca86b7826", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.103']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--791d9ca1-9843-44e8-a0e3-c59fc777374c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8bcc63fb-1c0d-4c32-9a8e-24eab4410528", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.37.117.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e3314c7-702a-40c4-8846-35a49cc9eb68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.42.231.160']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3eb233a-0425-4ade-b3d6-05cdfb6ead82", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '9.234.8.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c23c4fa-a311-42e4-83aa-eeda855b2ce3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.125.119.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e87ee41-44b8-45e4-86f1-2fcd447157dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.190.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed6b5d5-8b92-4d00-aac7-4a54b266177f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.118']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e094608-0daf-4aba-a734-11ef163423ca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.46']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30a1b50f-1b48-42a0-8a05-305eecb108d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.191.209.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf027123-cb9e-47d9-87bf-f32f272fc0bf", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70f9b2e0-3046-4df7-acf0-be1c18c98d13", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.114']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dab9a7d6-4ed8-44e8-8077-0f35871e7e55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a731423e-2685-4bb5-804d-95425aac6def", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1138f51-334b-4793-93ce-9eb792d4ddcc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef11185b-1dd2-4357-a849-5b6929dcff47", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--713b4e48-0ba3-41d5-9612-8d8d593b3bf5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.177']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade5f7e8-106e-4f19-a9a4-e0480eef89ee", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.179']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c2152cc-8aa8-49ec-8e83-47f5522f6309", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.181']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ce4d93a-32c5-40b2-83f3-b12f64a93bf8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.183']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d504bf8-3136-45d9-a418-2cbad870e3eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410829ff-0462-4ad3-9e10-d28e88c30aa2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--135bb335-af04-491a-930d-666fd0c4a8f4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d40a194a-68f2-45ac-b6eb-5e66f3010d92", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eb79925-950e-4389-9912-bfb0a9726c0d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.200']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ebc2db8-8fc9-4dd9-8bfe-634a4db5309b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bfb4591f-868e-414e-aba0-f7f7e658cc25", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e0810b9-9a78-427f-9b4d-c2566ecadc52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074b3a25-07c3-46d8-b8f9-32c3ed5c8990", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22ca1914-b093-44d2-a82b-8e10cb71be90", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.217']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--035986c3-fb64-4f03-8094-0aceda61f8f8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.219']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a3aa7d-0dc6-4766-8738-61fd970139e2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.221']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af59bb0e-9c69-4436-8964-406e8e241023", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.223']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b6b9606-b4db-4d37-9140-62a621d6a31b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--862c7d36-c40b-403d-8d7f-5dc71c0fcca1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.33']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b03e2ad-b5dc-4ca2-b614-3e9b485fca73", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.35']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f47a922a-916b-44c2-a510-a6e913ace3f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.37']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890ca897-2a2b-4421-a46a-40bc6483bfa3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.39']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65ea93cb-5cc9-4ce3-b2ee-4789e199cf9d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.90']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0807655-252f-4f2c-a6a2-18da114c7b52", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.196.152.98']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dcb1266-7a94-4c76-94e9-a36da46cca39", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.199.163.52']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c53182ba-758c-4372-9951-705fb44bcc9a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceantoronto", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.201.216.61']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceantoronto", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b42e05-b259-4521-b789-ff0336da77a8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.201.240.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7cf08a-d40f-47db-b1e7-f9c0b2cc656d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.208.197.64']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8931ad2b-c927-46e9-b27b-375f4d008523", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.223.69.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--220b97c6-50ac-4b06-95ea-4df5b2390c54", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d745130e-6832-4171-8fad-2a5ea3a68bd7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.224.92.32']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0144e32c-e910-4aea-9a72-1eab5be5ebf4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9406fec-60e6-46fb-92cb-b647fdc7e477", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e74be9d3-3c5f-490f-8a16-bc1fd7ea170a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.121']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0d6b285-3588-483d-addd-4a0713a66b1d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.123']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--976a0ee5-e51c-4778-bb46-7149ebdd68a2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.125']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ae9acaf-17f2-469f-96f2-81f428c7cd46", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.127']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0146485a-e310-4f7e-a0b0-678b0e7e7652", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c82c2ec7-d6fb-4eea-9ceb-82f71238e02f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7faac5ca-5144-4ccd-91e4-4f85437b8b3a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09663dcb-8f4b-4db9-a9e6-67662664d654", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bc9068a-560b-4e0a-b890-06da68501f8e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55508f14-be2e-4765-9da7-2ffd378d41eb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e55e45d9-c5ba-4c8d-9347-492db07d0d87", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e16594-52e2-4e13-9429-400b0bc7baf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7792b341-0402-4d94-8aa3-876170175cb9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669306ef-1813-40ec-a8a1-5ba347070e8d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3dd5097-f6d2-4d15-b2ca-7615dce7eb85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3842423c-2a72-4685-986e-5199d17e52cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.17']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1514fd4-da42-446e-87cb-c0e93b66d2a1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.170']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58e2b52-d76e-408a-a710-c743817a166b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85b5866a-f4ba-4736-893d-7a9cb9fdd815", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.185']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8de2d2dc-7766-4bf3-8349-1abd72e54764", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.187']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3adac008-16af-4c86-b71b-47ad7c0bea7b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.189']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0734bd6-020e-4c03-b084-541ba0f28f01", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.19']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b4b37f8-f325-4c64-b97c-5e4e3b1d66d0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aca7553-e388-4dec-b1c0-43b3ed5500fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d16720c9-6f2b-4cb6-82fe-d85935a28dca", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.21']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8b4a939-1a6b-45a7-86e0-9627712ede91", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c32eb0f-2120-4a4e-9712-baea92c9139f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45dbbb93-32ba-46dd-ada8-dc060d436d7e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bfedf1d-2f3d-41a0-9951-718e36016396", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.23']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c60f288-ec92-49cb-a574-6f1e046c3f11", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67ea558-9ddb-43ea-a071-662a6b420a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e113155-c626-407c-bc81-b28081686ac4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a1a313-e771-4f36-b5cb-1905e388371c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97021dfd-07a6-4486-882e-df0cadfb9b55", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec87313-07f8-45fc-9511-93c4446816de", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88644532-db54-4065-b77c-3d63d8018368", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c857bb0-82df-46ab-b6d1-2eacf7134f21", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a13bbe60-81dc-4ba5-87d7-df0cbbdf511a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.255']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de492dc0-4e15-4430-a368-9c8be2ab55f2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.27']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce06b6be-404b-4564-b682-3dd003ff46be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ef7feeb-c0f9-43eb-a4b6-93a4898591d7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1669a25f-55d3-4a2c-a80f-ee3e0615249a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b85b833-c7c4-429f-8577-94c5b37feb83", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77b90174-c9b6-400c-aade-5e7a3dfca21e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b88c63e4-a83d-4865-9cb8-11b9cd3b28f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eab23df-33de-431e-8b73-2b9ad0748bd5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.89']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd6a1ddc-1fec-4994-bf1e-72d928c939be", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e129be0-e99a-401d-9e69-1f04b68d3fda", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.91']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47b31a03-0b52-43e2-9993-dfa77a33717f", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.93']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01636921-25ae-472a-883c-16a3c904024d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.95']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69afad08-be19-4b7e-b23e-9bd7dd7713a0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.1']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ff4e9f-63f5-4a16-9e04-3cae6862a2e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.105']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62055634-1c07-4dd4-a78a-7f75867be3fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.107']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--781d8df5-978d-4e3e-8b14-9c5142809805", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.109']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c1821b0-a5f7-4e49-9a97-d4dd07af7aba", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.11']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d88b6d3-2218-4cc2-b2bf-f48acab99594", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.111']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--550e0990-cf70-4175-8369-c645a018b76d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.113']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--140c8df2-a4d4-4267-b02d-b508f101b5c8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.115']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--794251c6-3925-4baa-b37e-d82d72c76889", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df454bd7-292f-4c44-849b-1ee287f954cd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.119']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a252ccf5-2390-4720-97a2-afed129ab851", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.129']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0772b045-7e52-4487-9a8a-31812f0fbdfe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af0a7553-302d-4c04-be3b-9055b9107324", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47210d7d-c41a-4a7a-bf52-91ad144c3437", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.133']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a77fdbd5-b5d9-446b-abf5-34b14c523a80", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.135']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff0492eb-70a1-42f5-b5e1-ff6d2d2410d3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--816a3c6b-ad68-4a76-bdd7-b1f783349049", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.139']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19dd8bf6-81f1-4795-9300-66ad5ff9ef5a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.141']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a88fa33-f29e-45eb-8885-c7e41108f14c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.143']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--620b6d7e-7ac9-417e-a1c5-8f8427c133ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.145']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--966b44db-9248-4973-af12-9b8665d2c1f5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.147']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6a5aeb-6df1-4375-9a99-c4fcfaa56b69", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.149']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f738be-63cb-4def-97e7-e477cc3b46dc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.15']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7b3825-7568-4b52-929e-5b794a5fd6fb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.151']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62f445b4-d214-4782-a4c5-627623adb108", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.153']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7072fa1-b43c-4a25-b110-ee5e313c7a72", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4df6f7f4-099c-4242-b173-2e8c25fd20e9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.157']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d943a4-8ae8-47ab-9916-d26c342076a4", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.159']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2f0113-e11b-4160-aced-2cc8938ce5e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.169']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33697cbc-06e8-46d4-aaa0-2bdee4b091ac", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.171']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e278b0ca-fa4e-40cf-beb1-0c964035dc74", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.173']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1240397-969c-42e7-a9f9-a6f3bca08765", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.175']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5964635-3316-4471-8698-aab6128ed8ce", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.178']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7494a5eb-ab1c-49b2-9842-efdc15cbc6ad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.194']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8d95763-a527-4fd0-a2c6-b50a01c64ff5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.201']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c368a7b8-0563-4f21-8078-03352817a453", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0534add-59c1-45fc-800e-cdf25d758956", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.205']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9510de6-92cb-4de0-aa0f-20de0c624ee7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.207']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64095ac7-79e2-4a95-a8dd-f813e194d922", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.209']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf60e8f-176f-4a86-b926-62199522218e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.211']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c52bc589-cdc8-4157-abbf-3f78cc3e98c2", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c64ba8cb-b034-4128-93ac-c139663c4db5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.215']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--336bd8ab-ce08-43b5-8337-b7384c17964e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.218']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e1b5d5-20c9-492e-8a96-be3f39812e85", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.225']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b4b028-2e02-430f-a606-a4b1fbe3906c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.227']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a200dc04-f973-43b9-8a6d-0346c4e3df3b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.229']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18a2253-8b11-4965-af8a-f9af82af8b75", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.231']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89a11a4c-2197-4410-ba5e-e09d296e3467", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca47a05-c41a-4f0f-bbb7-e2600a2d91d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.235']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3389622a-7978-4015-a3fb-a0a95ea27661", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.237']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d165e815-083e-4065-962a-3cf81ece22cb", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.239']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d161d9a1-d7e5-44d2-896f-76e0729e477c", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.241']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--152c1ba1-d816-432f-96e1-26796397f6a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f94ae6e4-1216-42b9-83d0-f8278619c6a9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.245']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd34cddf-2e90-4fa4-a40b-8fb60766f86d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be14e7f8-b6b0-4b66-b1b4-edb90db76362", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.249']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--475c3d3e-2297-4195-bd0f-147e7eac34d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae9a8aa2-c32b-4ae0-a1f2-ea0c8b50e8e5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.253']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776ce16d-fc63-4cc2-896b-4fb925843f68", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.255']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cca4b64e-9a4a-4ec7-93d0-cf8372d57645", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.3']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d7e9961-bc50-4f23-928f-c1fc0d9f2bb8", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.42']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45cae49c-44fc-441e-80ef-234ed5a6e7dd", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.5']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81f5a674-dbaa-43a4-808c-3b0953cec07e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.65']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fee21eb-3ac1-4e71-a62b-14fe0d664293", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.67']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c42a92a3-24ab-4042-a321-a70245af6bbe", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.69']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acf37171-7728-460b-a89a-53a1780c3628", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.7']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e37090c3-3383-4501-996a-54b5de35344d", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.71']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e64cd160-1bdf-4c7e-9220-8093e16bad23", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.73']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f34477fd-a28a-483e-8ff8-0efb4a6ce749", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.75']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48a3454e-6414-4c2e-8e30-99b22288769a", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.77']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bad44a34-1451-498f-97b6-1e640f85183e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.79']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82bc86e1-5671-477f-b4d0-1e20eeed2604", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.81']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9be8822a-9d73-4ebe-80db-7ca104630450", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.83']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d79e5627-a9f6-4843-adb9-b7f6fda430a5", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.85']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb29638-bbc1-4936-bb6e-aae902bdebf0", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.87']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97f610d5-04ca-4115-bd6a-a4c09f57a4a6", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.9']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--099dc12f-ab4c-4f40-a073-958b88556c61", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.243.167.247']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5e4df6e-032d-4f81-9892-1d094c837244", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.246.145.26']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbb09b8c-0d10-40e6-abec-08cb9a5cdf1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.120']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2552f31-19df-47d1-a8a9-a10ba840a0fc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.243']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373cbbd4-04c1-451b-83c4-27480b7dcc7b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.42.88']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f41f11-c78d-4629-938f-1591a6f06602", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.112.31']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b9f3ee4-c8df-41cc-8b5a-1407c9f91970", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.98.236.136']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3a779f9-419d-4d2f-a4db-91215e110b7f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.101.167.176']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c970c8ae-8de0-4f3c-8632-784bc4c79426", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.115.5.137']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88fe9d36-b749-498d-8607-74d0a9f0f8c3", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest, vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.236']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "sensor:vultrparis", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca24c776-4e0b-48d9-a432-eeec5b2ae42e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.204.138.191']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16580715-c702-4f5a-ab44-19e7bd793d40", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.204.138.198']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57f049a1-2209-4795-b128-3e16d6a58d2e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.72.166']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1f1e3f0-0738-4ac8-beb3-698aab889000", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.93.12']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5889fb02-642b-4c71-b661-e9d9f2bf1f58", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.174.95.106']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70a194ed-8a6f-48c3-ae01-2f4dc803fe5e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.49.0.112']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d23a87be-24c2-4d28-a640-a680ec15e178", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.49.193']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e0ff5c-e78f-470f-affa-c57c4dab59e1", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.102.55.16']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97f7a984-31a8-4e4c-b22a-e32344954e6e", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.230.254.22']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002f69a3-e4a1-481a-a4f3-dc56e79b6bdc", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.10']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6b68bc7-5662-4eac-bae2-15049e24f677", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.231.206.250']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--738f6083-a95c-4b17-9ba4-782b5e021a22", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.243.11.124']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cc3143e-8ee8-42b8-804f-fce0d8248588", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.243.14.13']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff17139f-27a5-4a21-bb63-95a13413bc1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8956df17-1c80-4202-92cb-0aacfa56ecad", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.106.30']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c2de1e3-ab93-4226-a87f-c22b6d25a515", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.26.88.29']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ec38c0d-3df4-443c-8249-89978360a7e7", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.29.124.154']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2fd70ee-07ef-4b77-a7e2-827679029dd3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.74.126.203']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6ad152d-6893-47f8-ad2e-e6a317b524d9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.130.170.146']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0fddcc04-1f11-4475-8c57-9e7ccbb82d0b", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: digitaloceanlondon, digitaloceantoronto, vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.182.81.25']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:digitaloceantoronto", "sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1c5005f-f66f-4af6-995b-b0a67504c2db", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.214.52.233']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--090d586f-fd64-4a93-bd4d-05829dd35732", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.32.14']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17b8d76f-6cb0-48d2-8e2c-e5b80372157f", "name": "Malicious Host", "description": "Observed: PORTSCAN, SSH activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.58.255.251']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9c715c-420c-45ea-9f00-3a0c08392bb3", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.87.231.131']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ac0a558-ec6f-4dd2-8035-4e7312ca8b9b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.126.101.34']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec93b908-d0b7-4262-b492-d4f691be119f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.127.153.174']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--098ddd02-b0a4-4539-8c44-88f712b04d1b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrparis", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.40.157.40']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrparis", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d426f7b-c3f2-4517-bbbe-e895fd96216b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.133.213']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83b6e7d7-577b-4bd9-86a5-13a000066c1b", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.107.141.150']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e842171-7066-45d2-a163-e33bb282befa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.81.55.163']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83469504-197c-484a-a749-3461434974aa", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.84.153.117']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19698c72-52bd-425a-b973-cc801b61dde9", "name": "Malicious Host", "description": "Observed: PORTSCAN activity. Sensors: vultrmelbournetest", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '98.94.27.155']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:vultrmelbournetest", "protocol:portscan"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbce3109-a41a-4a8d-a953-14f852934648", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<!doctype']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fa0b587-9c7a-4a64-8d0c-a5d7ab5764fe", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '</body>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba03489d-20b2-484e-8b4a-0663bce34149", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '</head>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92f8d45c-6d5e-4f2e-b2bd-495d183b435c", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '</html>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6ec4f07-2ab0-4d6f-96a2-21854bbd4660", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<body>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7219759-202c-43f3-a132-c99b5a7fc07a", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<head>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79e21e5-d8d7-4ba5-b256-5f1a2cf376f3", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<html']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13a23f91-ea12-4aec-aa24-e54732a4ebb6", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<link']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3d879b2-0d5d-4f2c-b253-54d3211070b5", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<meta']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--363bce6b-cd6f-47b4-a8a7-32cf9b7c319d", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<openclaw-app></openclaw-app>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c02bdd0-e067-4cf5-9327-c6a620686870", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<script']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01d2fb8-cc57-40ac-9efd-06cd0b475516", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '<title>OpenClaw']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad23784d-ffc9-4013-ae9d-0cf77583de90", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'Control</title>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1799f41e-116e-493f-b380-f3f3a46f31e6", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'charset=\"UTF-8\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcbdf101-6cc4-4aba-acbb-bae089f6b5ba", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'content=\"dark']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734543cc-7e41-4699-9077-f2cea762b45a", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'content=\"width=device-width,']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a7ace18-ce41-4fc8-a293-e26dab3149d3", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'crossorigin']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7073f220-0a6b-4c11-833a-d02c0bd98c85", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./apple-touch-icon.png\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b19b4b1-48d5-45d9-8eb3-7c9c641fd29d", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./assets/format-DeRVtGzv.js\">']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cee7287e-36e6-4a56-8d95-e3d9256e5351", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./assets/index-DmrclaY-.css\">']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc2862a-ef62-44ff-a4b7-87a191154deb", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./assets/lit-BZwq2xLD.js\">']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99d0410b-745b-466f-a838-9400fc4dd79b", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./favicon-32.png\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17af088d-b1e9-4fcd-a1c4-5ed09e24373e", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'href=\"./favicon.svg\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cd4def1-8272-4d52-8899-184789aed123", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'html>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20c92e52-f9fb-4ecb-bcbf-64e36f377c6a", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'initial-scale=1.0\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18987098-a7f4-4cb5-b60c-dcbf7a9642b0", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'lang=\"en\">']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d281a3-3e26-4c11-a521-7ae8f90ad588", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'light\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d18c28e1-d3c2-47b9-8ede-af1bdf051aef", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'name=\"color-scheme\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdd3e739-1440-4ad8-837d-6378a2794dbb", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'name=\"viewport\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c7a9536-a445-4eb1-b982-d9673a3b85b2", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'rel=\"apple-touch-icon\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f41d20ed-0b32-4f7a-9da5-bcd4cd986904", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'rel=\"icon\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dacd9b8c-a3a4-4574-9938-c702d56ba22f", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'rel=\"modulepreload\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad433d92-7c53-4b3c-b8ad-2de75695fbeb", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'rel=\"stylesheet\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa802972-6c82-4589-8a52-98a7262bda5a", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'sizes=\"180x180\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--610aa701-0dd9-4c15-a1e7-9642fed6a1e8", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'sizes=\"32x32\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49f3cb52-9315-4ef4-b89e-b8ffd961c60e", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'src=\"./assets/index-UvgeZ3yV.js\"></script>']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0391e3f8-1569-4e6c-b3a6-cfc1863e174a", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'type=\"image/png\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3627692-57b6-42c7-9850-e62e255f05fb", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'type=\"image/svg+xml\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd7208df-3809-40ef-80db-b70645d645de", "name": "Malicious Host", "description": "Observed: FTP, GIT, MSSQL, MYSQL, NTP, PORTSCAN, REDIS, SIP, SNMP, TELNET, WEB activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = 'type=\"module\"']", "pattern_type": "stix", "valid_from": "2026-05-27T00:00:00.000Z", "valid_until": "2026-06-26T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-05-27-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ftp", "protocol:git", "protocol:mssql", "protocol:mysql", "protocol:ntp", "protocol:portscan", "protocol:redis", "protocol:sip", "protocol:snmp", "protocol:telnet", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29322fa5-d257-482e-a454-afc4c5cf543a", "sighting_of_ref": "indicator--cc093854-7f7e-4c52-baef-01db96f2549e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d583cf16-bdc4-4934-b7ad-a8a36e575c70", "sighting_of_ref": "indicator--4c61e1e4-a02d-48d1-b76f-40b4a1410bee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96216d8f-e49a-468c-a24e-9b3694cc7439", "sighting_of_ref": "indicator--2e913fe2-6f1b-4d16-a898-6834859b38cc", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d689455-9c61-4f1f-b357-7b6712ceeff0", "sighting_of_ref": "indicator--91d14aee-87f8-4808-b18a-4e2a8d0705f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e1dc0c-e4f9-417a-ba83-221a4bdddff1", "sighting_of_ref": "indicator--aff757ef-6429-4aa3-81cc-aadffeb52376", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cb14e10-3caf-4371-b48d-488c501c82e6", "sighting_of_ref": "indicator--62197380-5f67-4039-9626-bd80f711bd2e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a917a48-29f1-433c-bd53-1b760ee00b2e", "sighting_of_ref": "indicator--a5698bfd-4cdc-42ad-93da-8188e67fd9c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14c1f648-2fa2-4de4-b2a7-f8c645b791cd", "sighting_of_ref": "indicator--d6c9ccaa-3773-4077-9f9d-1f797ca45553", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2452bc27-79bb-4c8f-a4cc-a7071aaf4bc9", "sighting_of_ref": "indicator--9ce65315-0713-4f65-8214-918a868806c5", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48f4a1d-2d18-40ee-b746-aa63b23ed5e6", "sighting_of_ref": "indicator--863609dc-1bcf-472d-838d-4d67155ec519", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f288fa60-f0f7-40fc-83d4-031c04fdb1d1", "sighting_of_ref": "indicator--497331b6-1054-4ca6-83f8-c5275f467d7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75048d39-6bf4-490a-b373-18097e567061", "sighting_of_ref": "indicator--24e603e3-bfb8-41c1-9ee0-fd182d37218c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--238b4e46-3cdd-4f47-b696-114217b43343", "sighting_of_ref": "indicator--3211e8b1-f546-4e71-9abc-9cc915d39055", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f6cea6-5e95-44b5-a2af-4f408a95237e", "sighting_of_ref": "indicator--381a84c4-d215-4833-aab7-501874e7e855", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d3c26eb-37ff-455a-b441-956b3d893334", "sighting_of_ref": "indicator--fc7cb96b-3820-4d77-98df-32b6d5d87318", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02ec1f97-46c7-4cf3-8092-08cbac8706aa", "sighting_of_ref": "indicator--c058d9b1-0e5d-4c42-9b59-492b0e00c813", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dd6cb48-98ae-4b1f-9433-782451f3ab99", "sighting_of_ref": "indicator--cb4df340-4545-499b-b31a-5d6ad1d38c2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f08ac5-b8b7-4b61-a8c1-4565f7b16051", "sighting_of_ref": "indicator--8f80a632-216c-4d57-ad8b-0997d9f9d5b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--957fbaf8-8e35-4046-a883-f2cbb2a6e53e", "sighting_of_ref": "indicator--fff33c3e-6ee9-40bd-9710-c9dd3dc130c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e42f940-866e-4db6-b0e7-5a3e696d918c", "sighting_of_ref": "indicator--79b8be35-ccce-40d1-8db3-2cac92cdda74", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ba82a4-5b18-4045-be28-1cdf428ac83a", "sighting_of_ref": "indicator--6858474c-a3f8-458b-9d37-b1a690d09e14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b774912-9231-43d7-81b5-d43aa5f77c6c", "sighting_of_ref": "indicator--0d98a78d-1c0e-4e2b-a3f3-923bf5844914", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5a89cf-1c4f-4526-b2e1-a81a429dda49", "sighting_of_ref": "indicator--e2bb063b-8f44-4482-bfd3-e3ea973c498c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc69d19-1cf4-4ead-8fad-f425463056f8", "sighting_of_ref": "indicator--a4cec838-8fa5-44ca-a401-b6d48ede7af1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458fe9ab-9074-4439-8724-b0325590fd5f", "sighting_of_ref": "indicator--da5d2319-b6c1-499b-9063-e010afd2bb9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd52d8b-305d-4a97-979a-dfcb0a05005a", "sighting_of_ref": "indicator--566f79e3-5a1c-449d-af61-76b96d64b2f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a47b932-a8af-4e89-8f23-4605265875c0", "sighting_of_ref": "indicator--31773f2f-d952-4553-bb2f-71f9ce1ccddd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3042011-405b-4eb2-a16e-be2bb420b463", "sighting_of_ref": "indicator--4da7e822-3ed0-4aee-9119-66e9f6466a01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7f80fbb-a0a3-4469-ab1d-5a1210c491a9", "sighting_of_ref": "indicator--1fe071c1-6026-433f-bd6b-4a7577cbb2f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7aa5504-5275-4810-b772-95fb143fd390", "sighting_of_ref": "indicator--bc358ddc-8377-4a30-b4d9-a81a55e109d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--502453e5-7fa6-4b98-a4e0-f05964612ece", "sighting_of_ref": "indicator--59e0edc0-2a1f-4d3d-bf32-87d373189039", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f826dd-93e6-4178-a4b4-b0ec4ac972db", "sighting_of_ref": "indicator--19e53345-f5a6-4d1c-81fa-070ec22c211c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54588499-9f1e-4ad0-afde-c702b94e9770", "sighting_of_ref": "indicator--2d57a9d5-bbbb-4cdf-b93a-8b58ff1435ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34da9d6c-99db-433a-84ce-f21b9510bccd", "sighting_of_ref": "indicator--a294924b-e032-48f9-9423-c4e94b9fbd64", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d95ed24-d0b3-46aa-a665-901a26ab0896", "sighting_of_ref": "indicator--0ffc20a1-5645-4c76-bf82-72f65037b714", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ba7e32d-a7be-49f4-ae52-4989fef8f0d3", "sighting_of_ref": "indicator--5ea99784-41d6-458c-b001-f491b3b050e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d967d7f-7bfd-4a6b-8b25-bf76ba6eca09", "sighting_of_ref": "indicator--fc3619cc-a05d-4e9f-9953-481a32ee26b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb7d663-b00f-4269-a2ed-96784df7de4c", "sighting_of_ref": "indicator--49202eec-fe03-4c05-bf3e-68e0c531cd45", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1cc69b-c100-4bce-9352-0d05997b4c07", "sighting_of_ref": "indicator--25f325ec-2fde-40b1-bd0a-8150035c7c46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f8553ef-15d2-4cfd-85df-7b4ea62337f6", "sighting_of_ref": "indicator--4746e59b-e480-4286-8176-9addc70227ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0850c2f6-f682-4c98-8699-b0e01e35a85d", "sighting_of_ref": "indicator--267304db-df16-405c-a79e-75afdb24a23d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a7b6972-f847-42b8-904a-84bfe824804c", "sighting_of_ref": "indicator--9cec5188-a635-4c18-a162-6ff023b9ebc7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a65b2c9-ec8b-4870-97a2-7353a7d7e562", "sighting_of_ref": "indicator--f5634d5a-7991-4767-b502-893cac123863", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64af3efb-85ad-4d76-a18a-c9ca406b358f", "sighting_of_ref": "indicator--5ceff63b-1b87-48e1-bf76-694b47e4414d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74ade4c-81f4-4306-98ee-7fde1cc91dad", "sighting_of_ref": "indicator--6db01549-953f-4b73-a76b-6eccb074cac5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35120bd-45f2-4fa7-94ca-db4eb469ea91", "sighting_of_ref": "indicator--7606a0ab-ebc0-45ae-a4c8-6edf74c4dcd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f44cfb5-9fd6-4938-b0bd-f610bc16833b", "sighting_of_ref": "indicator--e428cd5d-a207-4103-a70b-b1781c2e63f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3a6f35-aa8d-4572-a0ad-a08b0d7bdd8f", "sighting_of_ref": "indicator--e03cd791-b158-4e13-86a2-d8670c6ea56c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1040723-6a73-414e-95e8-0d0fb3f8ef46", "sighting_of_ref": "indicator--68c77dcd-f7e4-46f1-9a5a-2af925fb5e8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270391f7-f1cd-45ed-8e09-26b62ad2b268", "sighting_of_ref": "indicator--076d5227-4172-41ea-ac4b-940b72270546", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32cffc15-2dc3-40f9-a737-307b0aa1487b", "sighting_of_ref": "indicator--1c751457-bec9-4b12-8014-6bfb408682fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c042e33-2274-4f9e-a253-1d4701d4d7b6", "sighting_of_ref": "indicator--f77052d8-5849-4c41-8fa7-e53b7567e1fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42435f0-19c6-4577-af55-961c81681751", "sighting_of_ref": "indicator--06483a39-ffcb-48e2-9ef8-3758c23b5ee7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0915b9ac-6240-4950-9174-fcbd40b828f3", "sighting_of_ref": "indicator--7add1621-ca5a-4c36-853a-e472537ade5d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeaababf-7a1f-452a-b8d2-b0f791000f76", "sighting_of_ref": "indicator--1429797e-1700-480e-93c8-1d155c0c5c8a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b59e2e1-62d4-4ba6-97d9-6792ebb64e5b", "sighting_of_ref": "indicator--a44638c5-8c1e-4ff6-a48f-dfb3f2875bf4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34b6bce1-8398-48b7-bea9-5c7b63db3fe3", "sighting_of_ref": "indicator--e11fdd77-998d-49ae-b876-6fa59f0cea5e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe8bc89e-1021-4a0a-b4c4-d99c4984779f", "sighting_of_ref": "indicator--c9f7c9ef-0fdd-4122-a15b-7c1aa0e9f56e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c8c9cd-01d4-4d62-b5ef-09c34322e3f6", "sighting_of_ref": "indicator--63d33ba6-86e3-44ce-b83d-0ad472ab69cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a75ade43-0c55-4a28-a312-d0272a3127bb", "sighting_of_ref": "indicator--0dba35d7-76e8-4f17-9743-877251ce880a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--922823c4-b090-4e44-a462-5b6a9bd784f3", "sighting_of_ref": "indicator--341c70ac-2d36-47a8-9ed2-ed156296b24f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3667e6f-2ad9-487b-bf12-78ab3e8bf3de", "sighting_of_ref": "indicator--58f848cf-b7ef-4ed7-98fb-c7d1d990d304", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092d868d-3c4a-437a-a671-df6097b76a7c", "sighting_of_ref": "indicator--827935f0-9323-4912-9a82-30531fef00f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd1eb102-a9f9-4326-bd1f-7de3e27eb649", "sighting_of_ref": "indicator--1136bad1-65a9-4aa6-8bd0-672f93b2c670", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba32fd4b-732c-4ea6-9df4-b69023ddbdbe", "sighting_of_ref": "indicator--29f3a483-199b-43bc-a289-5f46f165ed68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e1fefb0-62da-4463-8932-9f597e974085", "sighting_of_ref": "indicator--6441dab2-5a2c-4b14-afdd-ece56fce605e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d417b9a-d5db-4b16-b730-bdda8b8e3e02", "sighting_of_ref": "indicator--3eaf2d1c-fcaf-44c2-a0ca-12de65f9b869", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b704e29-b354-484a-85ac-178233c87892", "sighting_of_ref": "indicator--fa63467e-e49c-4e74-b023-cecfc4303501", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60c23f7b-ce9e-4b9b-be94-456716ba3cb7", "sighting_of_ref": "indicator--03aa641f-8f65-402f-b3d2-dc92757fef67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d57d01b5-2120-4a5f-a4f1-209d2802aa38", "sighting_of_ref": "indicator--01ff88ec-0b5a-4ec6-a5ab-194a583ec5c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754840c8-9bfe-491e-820a-e5aaf775c927", "sighting_of_ref": "indicator--0e1dbca7-9c8b-4080-b539-38567cb02bb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34839924-a86a-438a-a21a-9015502ee9d2", "sighting_of_ref": "indicator--fa8f5aa3-5bd7-49d6-977f-e800f02c4c2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74aeecf-0458-4164-9611-15dff56322de", "sighting_of_ref": "indicator--6b2db0ee-0d6c-4911-b93c-f6dee6e1f940", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8d2a0ef-cada-4cb4-b3e8-7f5ccd3c5557", "sighting_of_ref": "indicator--b41c366f-6fdc-41af-aa32-b372d73b06c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d615822a-af68-48d3-8bd0-10833692bc2d", "sighting_of_ref": "indicator--f6731015-d5ad-4109-b2d2-df04a19987e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7473881-0810-40fb-9907-b596e7d7865f", "sighting_of_ref": "indicator--aea3364a-0664-4e41-a848-3600b575a392", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d058a3e-c7bc-4df1-bce4-287801c0234f", "sighting_of_ref": "indicator--4d4f9fca-95df-4c6d-a716-116f14754352", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26558377-20e5-4128-8304-66a1d1e7c402", "sighting_of_ref": "indicator--233468c5-8249-4e1d-b745-b6bb47c7026a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11754622-d4d8-49f6-8452-d665979633d2", "sighting_of_ref": "indicator--0a0c123b-0da5-46d3-baa4-4c036d250a55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e28ede1-9376-43f0-b154-650533b7d628", "sighting_of_ref": "indicator--56ceb7b1-87e9-45bc-85b5-7f70e11867c0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948d9501-0050-42e0-87bb-fbd0009f52c0", "sighting_of_ref": "indicator--4451e090-0cb1-4f38-bff7-3eca47acce26", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbdab2e5-9eee-43b0-b799-50cbd2b047e7", "sighting_of_ref": "indicator--96c6068b-aba8-43f8-bd92-120e17fb6289", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935752de-cab0-4288-93ff-54b6b7f1c463", "sighting_of_ref": "indicator--ac47798e-386b-4cb1-bff7-efdb609f9459", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7659050-0575-4eeb-8484-f09288ed31a2", "sighting_of_ref": "indicator--bb29213c-08d9-43e1-b892-173f4b88ee7d", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e67130a-b775-406f-a1a7-823c8ff6e879", "sighting_of_ref": "indicator--6937b36a-bed3-4570-a226-d770431a5611", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d71f8335-4789-42da-8dbe-2a033da16c92", "sighting_of_ref": "indicator--5a4a7d8f-b8d9-4f3b-843b-bc9e3396765e", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06531a06-4ddd-4f64-b2b7-3bca0a3eef27", "sighting_of_ref": "indicator--95ecf8f6-e4de-4986-b9e1-f5f1ed04bbec", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6ba91a8-2d8d-4665-b7ee-4a545847f372", "sighting_of_ref": "indicator--0a3087cd-2d83-44d4-a05d-9a38e7460088", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfdbeee3-c808-416b-afc6-4b1661738e28", "sighting_of_ref": "indicator--3716389d-1bf6-4da3-8926-58f650371c2e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e00cd94-6dee-47a0-9847-5b9801fbc787", "sighting_of_ref": "indicator--24257e58-9843-4aff-9f7b-1041885df4d0", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f534864-5c53-41b2-9642-f55395b28f84", "sighting_of_ref": "indicator--0a2734db-0db6-4ad9-97f2-0f1973bfdec0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2ca15fa-13a2-4bcc-bda2-0370ae825a22", "sighting_of_ref": "indicator--68ab36f8-0a8c-42ac-8e18-a8dd4c727b9f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87cd91f0-c3ff-49a0-9a58-3885e268ff65", "sighting_of_ref": "indicator--6f391d24-a498-4d93-9550-d11b05cebbbc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b58f855b-7092-4478-9768-bf5852f5a0c6", "sighting_of_ref": "indicator--6c52a63e-2ea2-4a79-a1d2-05b7a896ec76", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77776cf5-4269-49c2-9069-3d3bdb4f49b6", "sighting_of_ref": "indicator--08caf020-4742-4835-9231-0183315066f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d67444aa-1ba4-4726-9eab-b3b9e09bd962", "sighting_of_ref": "indicator--643d77c1-70e4-4203-9433-8a7e0b772c21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092e2bd8-91d6-477e-823e-b739690e268d", "sighting_of_ref": "indicator--4ac32509-5fbb-4663-9ace-eea40a9cdb86", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dce35693-a1b9-419a-ae44-ee51dd567d76", "sighting_of_ref": "indicator--d599394d-ca66-4605-8bf8-c177bcc69aef", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34e2bb90-3d46-464c-b270-c5ecead2c252", "sighting_of_ref": "indicator--71b06a27-ca53-4b0b-9bf6-882073b68a66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18572dfc-168b-4abc-925d-a352df44d607", "sighting_of_ref": "indicator--05e2c381-af24-4c1a-9b26-3da4a4b2c06d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--814d369f-739e-4bdb-90a6-33435c6e1ba9", "sighting_of_ref": "indicator--db91773c-a80b-4036-89c1-2fc6d223011e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04ae947-4cd0-4768-9c61-a4ec3bbdcc60", "sighting_of_ref": "indicator--99a89027-8d87-427d-869e-5ade429e6e64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40c804ea-8d9d-4ef5-b6f4-38b815786a96", "sighting_of_ref": "indicator--d41f6c5d-4b43-4022-b1c4-0689a84671f2", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef564dcb-3de2-4fa4-90db-f278338935ba", "sighting_of_ref": "indicator--0dcf7302-ffbb-4567-8962-f3c066a408b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aedb7d51-0dff-4341-8bd1-8090176c52ef", "sighting_of_ref": "indicator--ec5013b0-ee37-46fa-b735-737dc4e3af28", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca260773-eafa-468b-adf3-aa737722868b", "sighting_of_ref": "indicator--6b43bfc6-8dee-4896-9f20-115ce698e50e", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--566674dd-6e1e-447a-817e-6b8f70a885b2", "sighting_of_ref": "indicator--1f6ac1c5-9fda-4af8-a1f9-1c6410e69c0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ee6a8d8-7462-4896-a49e-a1fdce8eb1ec", "sighting_of_ref": "indicator--fb56654a-3e5b-42c8-942f-83722eb845e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bd86e6-3d79-4193-86ce-809f9aee19a9", "sighting_of_ref": "indicator--7f9e02e3-98ff-44fe-b489-ecf05f9d13fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--878b5622-f915-4424-9d54-41d8fa343d16", "sighting_of_ref": "indicator--3efee99e-101a-467a-abe9-2a7571b85151", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0ebc8fe-02a7-41c4-a4e7-35a5bd263e60", "sighting_of_ref": "indicator--39a1d8c1-553d-4f64-b5a1-f1d8ed0b0e88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88d15009-f83c-4263-b452-ad9c9e46b9c2", "sighting_of_ref": "indicator--00ebbf09-a1ad-4b8b-8bb1-d5c74d9a86ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9110850d-3268-465d-b398-3f859f5b17f0", "sighting_of_ref": "indicator--1e9f6a35-91be-4166-937b-6813355d27df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b564670-17cc-47c7-b34d-0af34565e470", "sighting_of_ref": "indicator--9952bc90-77ef-4088-bef6-6dde1cc2919d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf83e3ac-f9e0-454f-aca0-799dda11d1ca", "sighting_of_ref": "indicator--5160b2f4-fbef-4ba1-ae0a-30001166c22a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aaf72ca-862a-4667-9016-ea639f74e3b4", "sighting_of_ref": "indicator--bb6a1df4-949b-4240-84da-22a365af2aba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b4c0a15-94c6-434c-8180-8b8816b6e66d", "sighting_of_ref": "indicator--9a2d69c0-4ac4-4177-9f81-4e112dc9d475", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d0de65-6903-491d-b201-da35eedbc927", "sighting_of_ref": "indicator--90474ea6-db42-4a1f-ba61-6e5ec2ab15f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452aba69-4763-4ecd-92b4-049ad8e9a381", "sighting_of_ref": "indicator--a4edc966-a323-4fe4-9f54-099d98bfecb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8065de9f-1085-4854-9f5b-a04cce4cb25d", "sighting_of_ref": "indicator--70a221a6-7867-4fd3-95f2-8017d1b1af51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aef17391-e434-45c9-b93a-7995874bc20e", "sighting_of_ref": "indicator--9df11101-4189-4971-97ab-9e720a70e485", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c32e45af-aad0-49ec-bca4-664354c1e529", "sighting_of_ref": "indicator--cced9428-85e0-44e4-8ee6-744c8764eb42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5f455ae-6388-4260-8253-4da39dc8170f", "sighting_of_ref": "indicator--ddec59f4-524a-47e7-abf6-ca6c8e7349dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d2bf25-4498-4d8f-aef8-a46fa08e8a36", "sighting_of_ref": "indicator--8d6f8488-69b3-4c6d-a4db-0edd6e618428", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42f3be0-e661-40c1-8312-388aad5c7afc", "sighting_of_ref": "indicator--a123d31d-8010-496a-9dba-72fbb256f06f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beb13648-b770-4d36-8d77-3f23d9155ebf", "sighting_of_ref": "indicator--1ae651be-f122-4227-b888-ec1082d9c61f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91287f98-2d93-4d60-9126-992a935dd474", "sighting_of_ref": "indicator--ca22f191-883b-4d3d-a66f-0467e702c356", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e404fe0a-d65e-4e29-9970-e9f6bfae9e1b", "sighting_of_ref": "indicator--ec0fb121-19e3-4777-8615-a655a02b92c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab948629-a3a2-4e13-beb6-d80eb1a4c165", "sighting_of_ref": "indicator--cdffc907-d0a5-43f6-8fe1-c4e454762e58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7da9115-9aa1-4343-86c7-b0939089018c", "sighting_of_ref": "indicator--24351e21-f92f-424b-ba92-da13c0886c09", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd67da2-800b-4fda-9f98-f21c6c0044dd", "sighting_of_ref": "indicator--7f0fed7b-445c-4b87-90a2-5b56069468dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e88a089-c593-4c99-9f38-ffc32b4a454b", "sighting_of_ref": "indicator--0e5901d2-4d69-4548-b8eb-c2b1caba0cbd", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--729aef38-1631-4eb6-9677-7491dba2af57", "sighting_of_ref": "indicator--eda76c85-7fa8-4389-bca4-b26c93922998", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6d0d8ba-221d-43dd-a973-650d10c5623e", "sighting_of_ref": "indicator--622aa0e6-1890-44f5-bda6-0dd02c550d5a", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cc36fa7-0663-4d0f-86c5-450e1ccb1bdf", "sighting_of_ref": "indicator--37b20257-fffe-4b5e-8dcc-18175b40df6d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aacd0bf9-139c-4f8e-8130-1a5457bf4a1e", "sighting_of_ref": "indicator--4da37ecf-65de-4950-85e0-c71e44d1f5e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036f8a5d-1d00-4a80-ab04-58a2d861d027", "sighting_of_ref": "indicator--e5913ad4-f3f3-4d6b-bfe2-d8f79e964b57", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fe6fdaa-7a5c-41e5-adec-e4d7e8f291e4", "sighting_of_ref": "indicator--6a2749b6-dfe6-4b62-90cb-48e39550c762", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fa61715-719f-41e7-9dc3-a07b8f783806", "sighting_of_ref": "indicator--921dc3e3-40d4-4c34-9806-a80cfd43d912", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69b96e1-301d-47eb-abac-d3f78fa34652", "sighting_of_ref": "indicator--1bafb4b5-1fe2-49b9-8e12-4d79dc57c44b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc809bfa-6e24-4f86-a58c-0a764223b04d", "sighting_of_ref": "indicator--0a314548-8513-4835-a8a0-79f2add9f229", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e578cfe-80d9-461b-a0c0-c9295ea0e43c", "sighting_of_ref": "indicator--1edeeddb-457a-4a2f-93c6-45250e09bd03", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213688be-fa91-4498-935a-bb97a333f2b3", "sighting_of_ref": "indicator--228166fa-de1e-43ce-8125-a459f6bbcff6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a41de5f-2e86-4499-93d7-9391815b61b0", "sighting_of_ref": "indicator--780b9e8e-2f46-48b9-a68a-fc709b71b8e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7828af4-8353-4f52-99b3-67f6e655ab5f", "sighting_of_ref": "indicator--95df311a-9dff-4617-8232-983811fea1e5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f29bcdcb-12a7-42ce-9b65-95f16c1750e5", "sighting_of_ref": "indicator--07ad1613-bfa8-44c7-8462-b597c5aee614", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91767020-b4eb-46af-acc0-6de554020dff", "sighting_of_ref": "indicator--cdaba7a8-2370-4bee-9ab1-c8bf1222d075", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5be26aa3-0f81-4bb6-9793-24abd235be27", "sighting_of_ref": "indicator--28e7e76d-50c4-4ef0-8ecf-2f9f811f580f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1ac3ce5-6c44-4045-a54c-1d3f06ab0c0e", "sighting_of_ref": "indicator--74049a0a-4791-4ad8-a801-799f83384031", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfbe7963-032d-4356-90bf-a18fc8584c65", "sighting_of_ref": "indicator--8fe3c00e-56e5-4909-9e08-fc6ec941c311", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44331642-fb7b-40e2-9ea2-bd706f10d15d", "sighting_of_ref": "indicator--c72a3cd1-34ad-473c-baae-4b4fbf589cec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0bb0a6e-2b9c-4ef9-b9ca-34c7ee749e74", "sighting_of_ref": "indicator--ecd9e09a-726f-47d4-a23f-7b6f4aebc4ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b98ff1d-1736-499c-9185-dc505a93729a", "sighting_of_ref": "indicator--5fe3d417-c73b-4cd7-9456-fb812cee64ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20419742-64e9-4dd9-88f1-fde720b08bda", "sighting_of_ref": "indicator--2595497d-3273-41ea-a43d-894247ca45e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f23ff2-6046-4e0f-9782-87f97acfaefb", "sighting_of_ref": "indicator--d7eb91c7-88ed-4279-b422-46b2c93ddf47", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b65fa0a3-70bd-409a-9387-e14e85e68e55", "sighting_of_ref": "indicator--b82125ae-df0e-4771-9f68-bae27e577dc9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10eddf33-7038-4ccd-9d9e-7f81bdfb61de", "sighting_of_ref": "indicator--09dab221-2e6e-42a9-900d-e0d13a4f34c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d3f87d-fe41-4589-bc3d-583277628cd3", "sighting_of_ref": "indicator--4a9fa29b-4e9a-4ecc-ae16-31e92144d1b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b467101d-a928-4d0f-9b94-0f5552b897d3", "sighting_of_ref": "indicator--06f34284-010d-47eb-b869-71e51ca86800", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c738ad-fb5b-4f17-99e0-0dd44871e040", "sighting_of_ref": "indicator--c496ee9c-e242-4446-a9fb-f065136339dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--239e0276-bc75-4516-aa93-3a2797fa9870", "sighting_of_ref": "indicator--f6e69293-bf93-49b5-9057-c24ef501a6e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6f52c5-be9e-45a4-bb5e-ed7c66791b2a", "sighting_of_ref": "indicator--b48fc40c-2623-4238-ae79-328241e1f52b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9ed1ce-0086-477b-aa2a-405010ab721a", "sighting_of_ref": "indicator--a14d74bf-ccc2-41d2-aa7d-7347eadd8993", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--688a2edb-e455-463c-b3eb-141095b58c09", "sighting_of_ref": "indicator--bfc2ec01-a534-4c8e-b2bb-32e3445aa24d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c5a96cc-b694-47fa-bae2-475181569bd7", "sighting_of_ref": "indicator--24e18c86-c9b9-400c-984c-e24ca59ebf9a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcbbd4f1-c558-4b48-bb34-72ab8df2c5f7", "sighting_of_ref": "indicator--96abbaec-aef4-4465-913c-3511bef8aa0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--032e0452-a235-4c1f-89ef-b9baddb633b6", "sighting_of_ref": "indicator--d2022dd3-5e88-4967-8108-4d7fd677f7c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efa6bf7c-c3f1-4e2f-bab7-a5192572ac4c", "sighting_of_ref": "indicator--0aa81ccc-1209-4d82-b857-8d114f787005", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--999de684-9fd7-4ab6-acdb-336f08c1cc13", "sighting_of_ref": "indicator--3adbfc29-3e49-4db9-af18-44c6b89b96a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab2458b-a933-41fc-b046-79c99fa1f742", "sighting_of_ref": "indicator--f893babc-2b2c-497f-800f-9d4d03ea6f74", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba9aae64-b094-4e87-ab3e-e02d8b505d96", "sighting_of_ref": "indicator--38540658-55c4-4a80-ace6-789cd8e42146", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f1b24ae-fe13-440a-bd07-944d9a0da7c0", "sighting_of_ref": "indicator--4ef7334e-8e59-4912-bb3b-b7a6b42c50cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58de9e6f-0221-46a3-9a0f-831f12236e5f", "sighting_of_ref": "indicator--08202778-a65e-4ec1-861d-4224682282ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--204a76ad-7e18-4df3-a157-be0c214fc261", "sighting_of_ref": "indicator--0b10e6f8-0d7a-462c-ab82-83acfb46256c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68188cd4-66dd-48d4-bf48-69300881bf6e", "sighting_of_ref": "indicator--ce8bf491-c406-4664-860f-5e537e917f6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6d9ee6c-a2f6-4769-8855-55589e32d5df", "sighting_of_ref": "indicator--4826fa5e-84a6-42ed-b732-f55f507cdcf3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0f04ed-fd48-41ea-bfb0-832e1d8b620e", "sighting_of_ref": "indicator--bb5fd47f-d574-41db-973e-d55f50f13d23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649f146d-c146-442c-bc2e-3fbd9b207e25", "sighting_of_ref": "indicator--03d09f57-dbf2-450b-900d-fa087beb15c0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37342b02-c820-4f59-b91b-d9f70929a9a1", "sighting_of_ref": "indicator--4a2b157d-ab70-4068-a13b-ad7c2cdb7ae7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb55260a-2fe0-4356-b6f3-9a9ea0acad5f", "sighting_of_ref": "indicator--b56bc350-1c82-4356-a570-70cb68c98764", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9272d4a-675b-44eb-9feb-7da5098844c7", "sighting_of_ref": "indicator--e2f69f15-f6a2-41a3-b207-387202fadd33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1479a1cb-44c5-458e-830b-a23e639de416", "sighting_of_ref": "indicator--de4fee66-ca45-482e-8c9c-9d470666936b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfebbf1a-4f3c-4c3f-a906-21af5f8c704a", "sighting_of_ref": "indicator--ea19aed1-e327-484e-bf54-21c5b547e44e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb63ab8-2c4f-4727-8aa9-16fac102d831", "sighting_of_ref": "indicator--319fb87f-572e-49c3-8c2f-0f3a04043481", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--600d7919-5d15-4cf5-9cfb-0dca607175c8", "sighting_of_ref": "indicator--de0b3804-f3d0-49d9-ab8c-30e5de2256d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--005a5f74-14ec-4081-be65-f47c363d720d", "sighting_of_ref": "indicator--bccb6c23-351e-428d-8f91-79e613f5e4b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1438ec68-09f3-4494-967f-1a2a16e1dc6e", "sighting_of_ref": "indicator--db997af2-aa8f-475e-bace-7e95b18651f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f93c2c85-771e-4eab-9e72-0171bbc0421e", "sighting_of_ref": "indicator--0b772cc0-8452-41c7-96b0-fe03b8fb1804", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87c8ff22-c3fb-4632-ba21-6fbc6973d3c1", "sighting_of_ref": "indicator--c4bba1c0-331f-42ac-97af-3f5741496e7a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1e06766-1ecc-4a1a-aa0e-dc9da4f36503", "sighting_of_ref": "indicator--757e7bb6-1fe9-49db-97a3-283e8ff8e38b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b22480-44e7-4129-80a2-88a24638f5a1", "sighting_of_ref": "indicator--6405f366-07fd-4c56-a0a1-1d4d051d1ac9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17079c71-caad-40fc-9bf0-459873c2b17b", "sighting_of_ref": "indicator--46538332-69c7-423b-9e70-c87b7acf4363", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec45eac1-c11c-4bad-be46-e11e255d4907", "sighting_of_ref": "indicator--de60d594-ec27-4379-a434-840e144a2a79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb1dc8b6-19bb-4331-8df0-f4d24f63ee7f", "sighting_of_ref": "indicator--933e89ef-ec5f-4fe1-88c6-a5a389a527d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db660de5-7b9f-4d85-938c-f8047498d8f6", "sighting_of_ref": "indicator--16211ca3-a925-4014-a26a-8fc8efc2f0ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--440fda9a-c574-4d56-88c1-451c14e251b7", "sighting_of_ref": "indicator--32978a0e-36bd-43b3-b5ce-8d653c2fe905", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbeff4e-bafd-4e69-abe6-7f9b806f64f4", "sighting_of_ref": "indicator--f840cbc7-316b-4271-a6f3-0b9fa3be0562", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e576b35-ae53-46f9-9f22-a3930675c63e", "sighting_of_ref": "indicator--c4eb21b8-f3ec-46d1-a7b2-f1119585971e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5fb4ee-6c76-4004-b7f7-4277563c0849", "sighting_of_ref": "indicator--ebb5940f-88eb-40bb-90d0-6938a081f2f1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e945dd31-9faf-4f00-9a9e-a033eb379653", "sighting_of_ref": "indicator--759628a1-3107-4c1b-87cd-9d504edf787e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4167b81e-0591-476b-a091-fc14c8b70468", "sighting_of_ref": "indicator--803076ae-1547-4bb0-a58c-241cbbd75c85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25a10319-8932-4ac3-94f3-5f6a0c4df2df", "sighting_of_ref": "indicator--43bdd3da-f31e-4f9f-872a-7733846439ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee407b06-a539-4161-a88c-5a5a3a645ed1", "sighting_of_ref": "indicator--c88fcf57-b895-41d8-829e-2d5f1388a8a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--712efcfb-bbb3-4733-93ed-228c15908bf7", "sighting_of_ref": "indicator--0fcf97f8-5ed6-4860-9e06-da5891214ecb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8e63c96-73f0-4415-b118-b05dc7ee2e6f", "sighting_of_ref": "indicator--5ca5130d-3fb4-4d22-a0dc-e193e023f0d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e972e647-ef9c-4632-8b60-f090c5f3674f", "sighting_of_ref": "indicator--04d45730-5b9c-4232-b1be-a3bcda819050", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a69e8f00-7a74-41da-a889-256d0b49e78d", "sighting_of_ref": "indicator--629aef13-45a7-4ae8-8493-09e7037d4bfe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f83d1653-4f8a-4a5e-8034-6036f8e36038", "sighting_of_ref": "indicator--b17f48a0-371d-4d0f-810a-fbaad59c0b8c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48d2c921-2ec4-44d3-868a-9340fd87e431", "sighting_of_ref": "indicator--a7c4d175-7e59-4451-9288-b6c7e207e48f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751f77a7-2a7d-48eb-91ef-416d8c8afcd5", "sighting_of_ref": "indicator--fff3a4d0-ab30-4efb-99b8-ef7a5e2e1757", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a5ae37-6a26-465a-a54f-f505e9b6407e", "sighting_of_ref": "indicator--545b26fe-976a-4ff3-a6de-b2e9db063135", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--430979a7-371c-4568-8731-8898bc17d18d", "sighting_of_ref": "indicator--e49f976d-04c9-43ab-928a-c142b063cde6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d82103b1-750f-4762-80b7-910a610a0f2a", "sighting_of_ref": "indicator--0c1acebe-6a02-4817-8535-f0fab3294e28", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea63bc3-040f-49bd-b2a4-dba8c2a1e93f", "sighting_of_ref": "indicator--c4169428-14bc-4d49-aa6b-5d007d3c9297", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a13bd07c-af4b-4480-bb41-1ec78b5d2969", "sighting_of_ref": "indicator--ec6e6b07-a55e-4916-af51-6f72b27480d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fcbee90-98ba-47c5-b154-afe57c9400b0", "sighting_of_ref": "indicator--f7bae6de-977d-4097-91d8-64a6509bd03f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae9231c1-dc21-4465-8282-ac8a92b6b533", "sighting_of_ref": "indicator--d5af5ca2-5221-4546-a6aa-02dc84efedee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a4523e2-5a7c-4a85-90b9-3fca7c4cabc5", "sighting_of_ref": "indicator--1bfbab64-2b53-46dd-9469-20532d943ade", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5704c560-c6f3-432c-b2c7-6d34ef997ce2", "sighting_of_ref": "indicator--1b484ffe-96e3-4904-880c-3fd0cd10cecc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61f2ca6-b78a-4422-bfba-a9a6f290ca2d", "sighting_of_ref": "indicator--9e674bca-f3ed-49ee-85d9-af701a0bbd02", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7533d6c-6aa5-404a-b586-b9f35daac659", "sighting_of_ref": "indicator--e2897a4f-24c8-4e5b-8b9c-d6b5e6bca648", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76772d98-ef7e-4b6b-8bac-7f3cb9ece5a1", "sighting_of_ref": "indicator--e7ff59b6-896f-4a52-a61e-4e2866f79697", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb777a4e-6946-4630-8d5a-913f1a18d07e", "sighting_of_ref": "indicator--aedef478-f1ba-40e8-aab4-9971e0e9bae5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--912c66c9-074d-4d93-ad83-e72cbdacf3f8", "sighting_of_ref": "indicator--60bf0b37-267a-4870-a312-e0ebf2c5fbc0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4c2b55-6b00-4077-8650-db83277d10d9", "sighting_of_ref": "indicator--1f74a8ae-ac9c-4739-87cd-dbd1d1099219", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e62532a7-42c4-4f6d-bf16-0421c1644ef3", "sighting_of_ref": "indicator--495aac09-c29f-4832-b15f-57828fb16b0c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc60e4ca-9363-4e9b-bd70-bc97b88dd902", "sighting_of_ref": "indicator--7d62fc65-8749-49bd-bf49-301959f61a37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a88865f-af75-4700-b6b8-717f55d6fddf", "sighting_of_ref": "indicator--2a02d226-067a-4911-8f60-4ac389136731", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da3133cd-9181-41ef-bb61-544674991c0d", "sighting_of_ref": "indicator--fba09744-51cc-4486-b624-4aa6d60059e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9535abf-ba07-4284-a0a3-e1ae53ebf8b2", "sighting_of_ref": "indicator--378984bb-77e0-456e-9f5f-e45a024ee50f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d364be66-5262-487c-a30f-a201503673a2", "sighting_of_ref": "indicator--3970a27f-e44b-4de5-b2f2-059e40308763", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab38b59-0e8a-4ba6-8155-f62d21d806a3", "sighting_of_ref": "indicator--829c67ba-7d30-4946-aabb-1dd354e98d28", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0533e7a-9b45-4398-9e59-4492e5f4ee09", "sighting_of_ref": "indicator--c2c5fa97-fffd-4354-b9c9-3101fddee7b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--368aebdb-a814-4a6d-87c0-dab48efbcb25", "sighting_of_ref": "indicator--7282747c-299e-4f2a-9c46-d34a8883d7cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5110d483-e532-4723-a66a-170ab33bd885", "sighting_of_ref": "indicator--45b4a915-60ce-4396-98ca-4408c6552766", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b67ffb6-c116-4b81-a9ea-483d3eb72cb9", "sighting_of_ref": "indicator--83a4bc1f-a54b-4933-93a5-c7a38c4c4ce0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62cc18ce-27ae-4e0b-9839-e1f16db147cb", "sighting_of_ref": "indicator--d8577e6c-93bf-4bac-9b15-e5ef14557443", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53554eeb-b96a-416e-83fa-9d1ede2e2e8d", "sighting_of_ref": "indicator--84fe7d4e-4744-4faf-a2fd-051c5e442c36", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5859c05d-1769-42ec-a0bc-369d80da6373", "sighting_of_ref": "indicator--f9b486a1-3532-4623-807a-78fad5542bfe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b2ffbd-b119-4e32-8dab-66324604a622", "sighting_of_ref": "indicator--3aff2a80-df1f-4f14-890b-20a780569555", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5928f617-937b-4102-8a3b-1cc441164e29", "sighting_of_ref": "indicator--3e141481-6566-46a5-97c7-72a9c964d9aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1450ef-9a6f-4381-941e-738dc3cd44d6", "sighting_of_ref": "indicator--054793fe-0571-4d82-9b15-78044e4db5e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--734a0d90-7608-4489-988f-f022f11190ac", "sighting_of_ref": "indicator--05cc3ffd-b6a8-47c6-9a07-202d9390da01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d68a0619-8739-4d11-a4e5-de184769f6f5", "sighting_of_ref": "indicator--679b8f94-9737-430c-ae52-f53218026e50", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b06e31ef-f748-4529-b2cd-714c1a9163bb", "sighting_of_ref": "indicator--0c422c11-ab52-44e5-8a03-7658cf6d51d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8a683f-06fc-4e88-8573-dabbbd6e5327", "sighting_of_ref": "indicator--2b5d18a8-e652-4e09-b721-14ccb132cfea", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045dca80-af5c-459d-bae8-f60e43f34310", "sighting_of_ref": "indicator--ca781089-34cc-4bde-aab6-ceb7b695d4bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661412de-1e08-45b5-b02b-ada863d7faad", "sighting_of_ref": "indicator--48cd78a6-ee4b-47fd-a7e4-db4c91dd957a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2f41626-a43f-46f0-9103-937b73585da2", "sighting_of_ref": "indicator--6cb1ce2a-d792-4bc3-bca9-884d0d761fd0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8b698b-c933-408a-90aa-c90e7d454b18", "sighting_of_ref": "indicator--28051181-35e6-41c3-ade9-366183b3d9ca", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7de386d-df12-45cc-b131-016251e76696", "sighting_of_ref": "indicator--4e8a67c7-4411-4ea4-806e-b8bf9512fc29", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd49992-3fb8-4167-b055-ba1f0565e378", "sighting_of_ref": "indicator--13cac14f-cae0-4947-9415-28b07b8bdd88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e55e390-0229-457d-ad7b-08dca8186025", "sighting_of_ref": "indicator--308adbbe-c670-44db-9500-ad0b1cf262b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32076fdd-2caf-4286-ad3f-51badcf18086", "sighting_of_ref": "indicator--97b49bf8-ee89-468e-a31b-7d685f0c6f8d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c74cb52c-05b9-4430-ab30-9a061f6db765", "sighting_of_ref": "indicator--159bc51d-168f-4fbd-aa8a-01aa4e4c056a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e04c8c2-57bf-42dd-927f-baa0cb2ed948", "sighting_of_ref": "indicator--02ffc2c0-4bb3-492e-ba63-6eb351fed1a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9150d79a-981b-4ad4-931c-de51b54c5427", "sighting_of_ref": "indicator--51385827-a7f6-46a2-a734-cf11f5dd2ab9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1767b1d-c5c7-4f9f-bcc2-c4825243b713", "sighting_of_ref": "indicator--8adde9ef-d520-463d-b940-a5a013882788", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53355eb9-70b8-4a78-8764-2a0bc7a0209f", "sighting_of_ref": "indicator--691e5536-969a-41cc-b78a-42e763a2787f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73dcde94-7aef-4daa-8a69-2b5ffd639bf4", "sighting_of_ref": "indicator--035b3dfc-f05d-4731-8506-c04931787fcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0089066c-7fb1-4826-a336-bfad18f99975", "sighting_of_ref": "indicator--7976e06c-d77c-422a-aaef-4beee9b7d5f0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4283fac-b817-489c-9e4e-7326cff40de9", "sighting_of_ref": "indicator--0f1a4f92-a8ed-4f84-a626-f45939d064a4", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--becfc59b-5074-44d6-ab21-f317fb532467", "sighting_of_ref": "indicator--d77d1520-3dfa-45f1-9768-b50c270f1cb0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1565214-2b6a-455e-8888-7616d22ad080", "sighting_of_ref": "indicator--eb3f84a5-8442-4c53-a777-271771521c55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e131d6-9ac0-4da0-93b2-97fd0b63c1d6", "sighting_of_ref": "indicator--bc4fa28e-6741-4518-af5d-8dfeaaed48d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ed04d9-57b7-4ea0-863d-57bc2f16e817", "sighting_of_ref": "indicator--c2ef83e9-ab3e-49ff-b4fb-0699a1792c50", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a66e118-3b7c-45ca-819a-21e8b61a5035", "sighting_of_ref": "indicator--7c25e9fc-3fdf-4fd3-8ff5-e663910fab2d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc7e178d-aa12-44e4-9c15-57dca5936877", "sighting_of_ref": "indicator--c2c230e7-7782-4c70-8c78-86baa5c4f065", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb08fb2-0fa1-49ec-80c0-c1e5c4c8d5fe", "sighting_of_ref": "indicator--c33b5093-6f23-4e24-9e85-30011de04c71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a42dd38-3e39-48b1-b880-4fa13902e364", "sighting_of_ref": "indicator--edd5adba-bb98-40df-9052-6f5e30e1dac6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dea0014-b404-49ab-93c6-06eea78f9471", "sighting_of_ref": "indicator--6b18f0ae-49a5-4076-a141-8b5a7671a381", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe38e0cc-4348-467c-8d6a-50156a86b4d5", "sighting_of_ref": "indicator--7cc58d12-d906-4fb2-9d68-aeafe04db2f0", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e92cdd9a-f4d3-45bf-981a-7d1033b95090", "sighting_of_ref": "indicator--bdd635ad-b91a-444d-9e91-35d5693ec668", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ab8663-b96f-4730-b620-179dc7c3dc57", "sighting_of_ref": "indicator--0ed0120a-f55e-4ea4-b235-fdc042f5e7bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5dfdbb2-8c60-451a-ba99-749e71b4fb74", "sighting_of_ref": "indicator--b9d7f6a8-b1f8-49b0-974c-a35dc32eb1e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515aebf4-bc45-4399-ac72-b5a3d8197c72", "sighting_of_ref": "indicator--a85a070a-2014-4181-af7d-13c4b89d13f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde5a5ef-db05-4df0-a1ee-cb223c4bec4c", "sighting_of_ref": "indicator--7ddb3df9-2a92-4b9e-a318-ba5895fe4832", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e6525f8-1ad4-4dac-a76a-666327da072a", "sighting_of_ref": "indicator--3eec5b74-2843-4038-b770-a7b9da048ccb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4a565fd-e34c-488c-8a73-66df2e2838f8", "sighting_of_ref": "indicator--26d523fd-2735-4700-8b8e-8212abf08006", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9df2b97c-688f-476a-8800-3c67a343fea7", "sighting_of_ref": "indicator--f68866e4-308c-490c-9ccb-604709eb6cfb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--767ca65b-dcc6-48e4-bc9e-46196a9326ba", "sighting_of_ref": "indicator--58d7e107-f908-406f-acce-39be20863b70", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a7a17ec-1ace-4650-a15b-411de61c734d", "sighting_of_ref": "indicator--dec37022-3a25-485a-b956-e018a6daa556", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa5f77b6-2545-4dc1-ae94-825adab02726", "sighting_of_ref": "indicator--6fe922c4-2084-4718-a1c7-74934ee70d8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8929257-8646-48d8-b6cf-b40963ff1d8e", "sighting_of_ref": "indicator--f7bf6021-6e88-4262-8fb1-55993baf8924", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3350d38-29b4-4043-9a3b-85264511b661", "sighting_of_ref": "indicator--d4c454f4-39b5-4416-94a4-4b68201b8127", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b4ad6a-cd29-4f25-a6a5-6822bdc38f6e", "sighting_of_ref": "indicator--bddb8e3f-c4fd-40e6-81fe-69a6c1cae019", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574528a8-d59e-4b5b-99f0-168c6a4e6346", "sighting_of_ref": "indicator--6056ca21-58b2-4988-bf4a-437f92d037b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e4dd77b-19d4-4e78-895c-7ee519b9f050", "sighting_of_ref": "indicator--f69b0283-4cea-43af-b1e6-588f95f47212", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd57fa6-7cd5-4031-b271-e317bc023412", "sighting_of_ref": "indicator--9c768f69-e93d-49de-b2e5-09beacee035a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03a61662-8190-47e8-aa38-c7944e41951f", "sighting_of_ref": "indicator--17d773b5-33a1-44fb-84a3-3b9a733a5ccf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69a6d3e1-e950-43e3-803c-eea73d0b3b5a", "sighting_of_ref": "indicator--d3f58789-0c21-4097-ba09-7cc9c1729505", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0dccf72-15e7-4d5c-acda-e81dba992c5a", "sighting_of_ref": "indicator--9898ccf1-db1a-438f-8432-36bdfe4c456b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ced906cb-f36c-4f6e-bfe6-1ef8fec6fb8f", "sighting_of_ref": "indicator--c2c3e741-5108-4efc-81a0-6d3d4ecee268", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe2f5d27-804f-4949-a65d-c0f9b820084f", "sighting_of_ref": "indicator--fe1b8a55-c22a-4964-a24e-581ff78e69e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f999ff-bc6d-44b0-86e5-df5c688832c3", "sighting_of_ref": "indicator--75b0d261-0326-4d40-b224-e31a47c58a36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66185abb-b025-46eb-a3a0-658bee6d1500", "sighting_of_ref": "indicator--a06eebfd-79ea-4254-b485-b0244dcc9b52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d17a91-424a-4b50-965d-6bd823f3f831", "sighting_of_ref": "indicator--f8ece286-812c-4390-89d2-00b7208f7d4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ed5326-0db4-47aa-8804-ebfe9e646007", "sighting_of_ref": "indicator--bcb96875-d012-4002-9790-5112ff146a08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5489b3af-ddbf-47a6-b923-c4401c13c5b7", "sighting_of_ref": "indicator--ed47837e-180d-4726-92f2-c00df78dca11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d49ab2-cdac-4614-a80b-77a40e5164a1", "sighting_of_ref": "indicator--c1745d91-2af9-4394-a7e1-22b1ae368f74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1be1d84-548d-4a38-8349-55d205f629a5", "sighting_of_ref": "indicator--5af7c847-a9c4-41ce-acba-9651b79629d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efdb0407-b298-4894-a7c3-fe2e1ab6795f", "sighting_of_ref": "indicator--8ba188ed-0502-43e4-b449-25a849bc7081", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afee510e-44cc-4f9e-b2e5-0d5a4b2162e0", "sighting_of_ref": "indicator--c6bfc93b-1b36-4759-92f2-f2665908c8b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--631d7cd6-915c-4c48-bea6-f7835a727787", "sighting_of_ref": "indicator--606733a3-b84d-47ab-b9bf-6cbfa5b576d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c42ee4-a0e5-4019-b29f-16d479552343", "sighting_of_ref": "indicator--99b2a2d2-3718-43f8-97c4-8f7185277918", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdd23ba-9a9f-4db9-a9fb-75c2ead922dd", "sighting_of_ref": "indicator--f116de06-c22a-45e9-8f77-0870cee77d8e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8938a51f-9146-41e2-b587-517cbcf1e6d6", "sighting_of_ref": "indicator--46348572-ce7e-4ad6-9c9a-922e5bf7b33d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d18c892-5bbd-4237-a069-8786199647ff", "sighting_of_ref": "indicator--d51bad4d-a50c-4e58-8136-f8eb286cdb01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013fa405-66b4-4507-91b9-002d47801539", "sighting_of_ref": "indicator--544255c7-ecaf-4269-882f-a4e84963b1a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3df326e6-3348-4ee9-bc50-f0722aaf2ac0", "sighting_of_ref": "indicator--4ea13112-7099-48ef-b039-877ae35d6a61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ed5bf1-f327-44d6-b7e9-538b230eabd2", "sighting_of_ref": "indicator--9d9ae7f9-a6bf-466d-a281-d1604844750d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6720235d-5255-436c-8a59-622f2599dab4", "sighting_of_ref": "indicator--e4e5da1f-5554-4412-93ab-4108ec74b210", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c8c333-ffd8-4ffb-a169-946062de829c", "sighting_of_ref": "indicator--9f33f135-5b07-40c4-a929-0ff4219e09bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--603c10e3-bdd8-4be5-8c71-8a357ea1feaf", "sighting_of_ref": "indicator--1279af4e-7631-4a26-8c71-f463faeb4919", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec8e720a-5f76-4605-a0f9-5e1f4676ef28", "sighting_of_ref": "indicator--864b4c82-0d95-4ce5-b0b9-b5dd0ead2198", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfd3751-7768-42f5-8872-eda0d26fd5de", "sighting_of_ref": "indicator--ba986867-c04d-4eb8-b620-663da278171b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e3f92f-a6a9-4923-ad63-8fcd78ae5ab8", "sighting_of_ref": "indicator--42b5617a-a313-4a38-b64b-7bff98164e49", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92121f8-58bd-45c1-a8ca-8eee2788f63e", "sighting_of_ref": "indicator--cd5b07ab-6371-4f1e-8116-8762e39ab873", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28512109-2337-481f-ba5a-09205894f0d4", "sighting_of_ref": "indicator--00b6790c-fbea-400d-a4f1-82a86773ccff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cbeb8fd-2b58-43d5-ba71-d005979960b8", "sighting_of_ref": "indicator--bd5c39e2-c180-4fb6-a180-8003d15424c5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b87ba14-4d9c-4948-87cb-f69e9955833c", "sighting_of_ref": "indicator--8ef72e77-958a-4529-ac1e-460b34c0a45b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28c63907-050b-4684-b1b4-c137a4d01f48", "sighting_of_ref": "indicator--564626a5-b235-4af0-9932-e799b9ee70a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d27edea4-c78f-4114-b1b2-fd18e9a07b70", "sighting_of_ref": "indicator--7fb6f59a-7e5c-4e54-ba02-8ddce88fca1d", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201f1792-2d64-48ba-a1a5-f09881e370d4", "sighting_of_ref": "indicator--4ef7f57e-228f-4d0d-b333-db1c9ae28305", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d31acb4-c4cf-448f-9284-5dd351f44f4f", "sighting_of_ref": "indicator--fa0909e8-568d-4887-bd1b-1d0da013293f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d010deca-0d83-468a-9924-59964c8a82a6", "sighting_of_ref": "indicator--2c153c4f-57b2-4cea-9f2d-b6825c45667e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b352e993-9fae-434a-a025-71174402f2d9", "sighting_of_ref": "indicator--f34837e2-e79e-41eb-854c-b9d156e8f1b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44d4e0dc-b54d-4171-af73-89b0a029d572", "sighting_of_ref": "indicator--85da7d1e-84e6-498f-8712-964796c72eac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae8f92d3-7855-40e0-a5cc-3d2086ca02ab", "sighting_of_ref": "indicator--25be016c-52e5-4151-8330-c66dcdf10904", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3899bcb-c945-446a-953b-ad4bac8bcd95", "sighting_of_ref": "indicator--8d6e1ac0-7d22-4704-bafc-ab544bac0028", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1150515-6cee-4f00-82fa-435f991dede9", "sighting_of_ref": "indicator--149e1e3e-ae6f-4069-96ad-ad63d4624c23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b410e8a6-4c3a-43e2-ba74-4449b2b1eeff", "sighting_of_ref": "indicator--dcd5d12e-aee7-4b58-9ba1-3de2d8c2202f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc1a8f57-aca5-49b9-904e-bb5e00a925a2", "sighting_of_ref": "indicator--62f076c4-0449-431b-a304-967cbf20a0eb", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91c3146d-9213-408a-bd09-2a077c28e575", "sighting_of_ref": "indicator--a08319d5-fe2a-472c-9e97-a4561aaceb29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--714cbd06-1503-49e8-a0cf-a74a92a026ad", "sighting_of_ref": "indicator--87ade067-1bd9-4129-bbed-9e92f85e45d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c540704b-d85e-4298-a119-5b26e842bee5", "sighting_of_ref": "indicator--77e91082-923d-4886-9d8e-bde264359fd9", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62082998-fcc9-4666-b7c8-0c145b10e226", "sighting_of_ref": "indicator--1200051b-6499-428e-9c55-bd346069b257", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57be57b3-6057-40aa-8b7d-81cf5a8c65e6", "sighting_of_ref": "indicator--d9ce61a3-c926-49b3-a70b-1ab3cf4213d3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f526c735-5d6e-424e-8283-69889f3a5d56", "sighting_of_ref": "indicator--81b764da-1c7f-49fd-8c8d-2daf4ae4d8d4", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf3ebaf-5e4f-4f0b-8b3c-9186212faecb", "sighting_of_ref": "indicator--4f7b2e49-ea28-468c-aaa2-cc79ac24f013", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b338140-0bb8-4f0a-9c38-89d10a22df17", "sighting_of_ref": "indicator--8fb4b463-d18d-46b8-8b77-c15af29689b7", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc2284e-3abe-4c4d-a8fe-8a0277faaaf5", "sighting_of_ref": "indicator--62404ff0-93f7-422b-99cf-9c910ee224ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc769b0-33a8-413a-bcd6-021e395a4db1", "sighting_of_ref": "indicator--dd8406a8-9c7e-40a7-b28c-ddad0af0c1fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5939e048-af15-4619-8289-1149cb795e5a", "sighting_of_ref": "indicator--0477dd13-5eb0-4787-aeae-f280a158decf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca62d859-3659-4e3b-9d76-71d6577591ef", "sighting_of_ref": "indicator--0a632e6f-baba-453b-a291-34d0704ff8e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06563a5a-db4c-4654-97a5-d9e9fbfd0b28", "sighting_of_ref": "indicator--2eb4e3bb-74b0-45dc-9814-1b3a29a7d1c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7319bd9-dc8b-49c1-85f9-65b4aec276fb", "sighting_of_ref": "indicator--4427b89b-32cb-4b35-8163-84fda1795fcc", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3037279f-de1f-45f8-a408-110429730b72", "sighting_of_ref": "indicator--d45c97bf-73b9-4f6f-b85e-1e3620adf3e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eea9802b-2637-4bea-9acb-df3f232aec66", "sighting_of_ref": "indicator--37ba7217-5711-437d-bdae-d1b3a01a18ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21cc8f14-a7b1-4628-87dc-faf80dfab0c8", "sighting_of_ref": "indicator--e18792a2-69cd-4c76-991f-676049b55713", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a2df3c-6aa2-47b4-aeea-ab16beff203f", "sighting_of_ref": "indicator--a83d9c4f-4a08-4ddd-b549-eb917cb33e77", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca926a75-77e2-47b2-b29a-2014a95eb87b", "sighting_of_ref": "indicator--707cecda-6f45-45bf-be17-ff930b3eb66b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0534380-8922-4153-8df3-74a6fa05651c", "sighting_of_ref": "indicator--e37510ba-07b6-4483-9051-bd20ac5e62a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e910cbf-1435-4935-80bc-cf6d79e81f4f", "sighting_of_ref": "indicator--0b43ec52-737d-4291-8988-1844392a2c42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11cd226-2439-41f7-ba8b-b1bb637a77e9", "sighting_of_ref": "indicator--c6801798-2685-422b-9691-223d9c976b5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53726f9a-6ae4-4465-b80c-daa741c70ab0", "sighting_of_ref": "indicator--557cfb00-641e-475d-9111-cd16d8391e6b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95e6175f-cc2f-499b-bd83-8db07b890ba7", "sighting_of_ref": "indicator--366ff03a-bc20-40e1-b208-5853a05dd0f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89369410-128d-4c88-8561-c5b69e359ddf", "sighting_of_ref": "indicator--54c0c62a-dcbe-4de7-9c4d-bc6926588bac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01f12b40-d716-4026-9f24-a552e0bc564f", "sighting_of_ref": "indicator--1eabd883-7f5f-4c01-b77c-118cd1a92b8c", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--722776dd-6426-41bb-aed0-d4834a02c24f", "sighting_of_ref": "indicator--0d0c2998-e460-4018-a1b4-2c7f2897367a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb7e983c-927a-4cab-8810-596ed05a9943", "sighting_of_ref": "indicator--9c5c1ea9-a521-46ab-83c9-78b76e6fb946", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--782d6183-25bb-492a-94a7-f5f74b983b5b", "sighting_of_ref": "indicator--d31b8010-6c23-47fe-b0dc-e9e9eb7151ba", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7aded74-948d-477c-b349-db9e58d5f0f9", "sighting_of_ref": "indicator--c7deeaf6-fbea-49a8-94f0-233d3992dede", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bcb3aa7-36d4-4ec4-b2b9-4f26260d1f57", "sighting_of_ref": "indicator--aaf51824-78c5-4e0b-96fb-dd78ed46360a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5c45d0f-7ee0-434e-ab3b-57f538f3aa47", "sighting_of_ref": "indicator--76385c3a-380e-4d76-9b12-7086de0d010d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23bd0358-57e3-43cb-a6a2-76f2a4c49af8", "sighting_of_ref": "indicator--8f8d79cf-3060-4c07-b10c-425cd1cfcbea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7073648-48af-4b84-915f-fb29adbfde1e", "sighting_of_ref": "indicator--af28da74-67ea-4d0e-96ef-2f65bdd84bcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1b56ea4-a9d1-42f6-b49b-173d8db60312", "sighting_of_ref": "indicator--e1b3c77a-a5cd-4dbd-a1b8-88a67a67cda2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c44e0519-e866-4bf9-bfd1-02f8a05ade3b", "sighting_of_ref": "indicator--04c09f80-6ec2-4bf1-930d-a7e0137315f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--509a2ab8-e2b6-4468-be7c-e2f160d94200", "sighting_of_ref": "indicator--9e3e3820-49f8-48bc-848b-a1f5a006531b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbe72cd6-b9ec-448b-bac1-055ab59687a1", "sighting_of_ref": "indicator--95f79c5e-2b6b-4fc5-bd69-386208344332", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528ca59c-0bf5-4dfe-bf41-922e9748db9d", "sighting_of_ref": "indicator--20e53fe6-3972-4e3f-a662-e7c2f8fb77d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--033d92bf-2a69-4dae-9b18-666536344b6f", "sighting_of_ref": "indicator--3923c44f-5949-4b5c-a128-1ff4c44ddeca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd0ca36-0372-4c8b-9379-8ceb8838ae3e", "sighting_of_ref": "indicator--6506a12e-bab9-470e-8980-2b8722e22149", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff121d9f-7f7f-4fd7-b2eb-e1ea783872c0", "sighting_of_ref": "indicator--c5bc2567-d60d-42df-8520-7f35e1bbc1b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e979cf33-e771-450e-a9dd-7f6a6b22e1c4", "sighting_of_ref": "indicator--eb26891a-ed46-4cbe-9f57-a6f7cf86a0ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a14525e-079a-40e8-a3fe-e42df5015405", "sighting_of_ref": "indicator--53f094e8-ff00-4a48-ba21-879188c28a65", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ed3181-5891-4f5c-ac59-c366a4a3f9e3", "sighting_of_ref": "indicator--1527d808-f171-4ac8-9c2e-55b08af6863d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8d31de7-baa3-4d95-83b2-99f7830e9638", "sighting_of_ref": "indicator--0d9ce4b7-83a6-47c1-a774-39f834b7e248", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b66620e5-61ff-4d49-bfa9-c242273ecc02", "sighting_of_ref": "indicator--0679a38a-1807-43ce-bcfb-5684e64c3dbc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7da6e4b-1f6e-45be-96b2-421c991c35ac", "sighting_of_ref": "indicator--59893d6e-6e6d-47be-9889-543fd6cd8627", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1ccfaff-1cb7-4996-89c9-1cfb9ccfafa7", "sighting_of_ref": "indicator--59f33d86-79c5-4a48-a502-f9e87d00fb05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc9100d-5ac4-4116-b094-334f4866eb1e", "sighting_of_ref": "indicator--b9cf763a-0037-423f-8ed7-8b713c2a5f31", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--104faf30-3e0c-4619-b0f8-522569b6a838", "sighting_of_ref": "indicator--e407b68c-9e35-430c-8c49-a68827817f7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b55aa12-1077-4cd3-a016-d38369115b59", "sighting_of_ref": "indicator--87cdb844-2760-494e-b48f-234dfbd9d3ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83236a9e-7c1e-4d8e-a38f-60a05042ed72", "sighting_of_ref": "indicator--62965e43-8618-42f1-a79f-a459005863cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1dbfd53-fc14-4255-88e7-3517105a2ac1", "sighting_of_ref": "indicator--143cb072-c1bf-4c62-bb8e-d985e9eb1990", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9870258-616d-49ea-aca2-1ecfe1983fb3", "sighting_of_ref": "indicator--df1d5729-c434-414b-8130-9563795d6204", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c85d64d-771b-40d7-a817-7ffb360ef1ec", "sighting_of_ref": "indicator--2f225daf-ea5e-4bfc-9722-082388b1a284", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3383ab-e82e-492f-a4eb-b2405575809f", "sighting_of_ref": "indicator--045e877a-92b8-46ea-8e75-ac561f1b65be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8fdf59b-c063-4038-ad11-7f46a106e44c", "sighting_of_ref": "indicator--dae53260-15db-4d64-8444-ef5b8aadc9fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e6b93e-98ae-4ad9-b364-683537594cc3", "sighting_of_ref": "indicator--7b1ff0d3-2c9c-4b88-9a21-ed186b0d90cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fa82ee9-beeb-4963-9bb1-3e7281c9040b", "sighting_of_ref": "indicator--8fe55a7f-0e45-44f9-93af-b6c18ca14022", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--508d539a-c8bb-4231-8083-23d99e8fa30f", "sighting_of_ref": "indicator--186241a6-c086-4199-986e-67e2ab4eb0de", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75bdea4a-4db7-4fd4-82d9-d0e8c06460e7", "sighting_of_ref": "indicator--42d00a1f-0aa4-4196-8ef8-9c07b5368536", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--994490a9-f040-45d3-8ccb-93168ed5a3be", "sighting_of_ref": "indicator--83408773-2526-4811-bbfa-2a62c36f99ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8367892-cd06-410b-8213-5c89829d8b97", "sighting_of_ref": "indicator--e0629ad3-971d-43e0-9994-6aee90bd5cb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcfce22c-82b1-47af-af96-e9fc8308a22b", "sighting_of_ref": "indicator--3075f027-e3f0-40ed-b9dc-1380371b436a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ae3884-ebfd-4447-abda-c4785736b3ec", "sighting_of_ref": "indicator--414511eb-e2ef-4cde-8146-f4ebbf04d1a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--307f910a-6b7a-4bfd-9db7-13fdb69c5134", "sighting_of_ref": "indicator--de17b854-67bf-4610-9f0e-7f5d95280043", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86fcb4b4-6cb0-4d70-a6e4-0380e3e6abf4", "sighting_of_ref": "indicator--9a14b355-0379-445c-9151-b648b25b3531", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab28b2bd-ebff-4e78-82a8-159756b3b7f8", "sighting_of_ref": "indicator--30e4b954-babe-4d7d-840e-0f585bbe987a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbc8b5b0-8495-40d6-bfb4-002cd18fc69b", "sighting_of_ref": "indicator--508e1853-ee16-42f0-bdd0-c93194a5cf60", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3881e055-9139-46ca-ba7e-ad465b43c1b6", "sighting_of_ref": "indicator--f2237256-5489-4a50-b4e5-d5bf1dea001c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6015d512-1afa-4bbe-bb47-2366eb236d16", "sighting_of_ref": "indicator--39ae670c-f264-4b79-8753-2c4b33667f80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--578cf49c-6cb3-40c4-a18e-294a93dc8013", "sighting_of_ref": "indicator--6351e290-6a16-4f75-b78f-e274533e85ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9fcdca-d6f8-49b0-a91f-353cba979c47", "sighting_of_ref": "indicator--ab65163c-9381-4222-9765-b5b63b39fe8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1fdbee9-e612-48a8-ba28-6e386e16dbff", "sighting_of_ref": "indicator--314020af-7167-4060-b113-1f213d96760d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11637669-cdc9-4c5e-b81d-13d017f0514e", "sighting_of_ref": "indicator--5c8cc5fb-3fb0-4ca7-94b9-4ff86074c9c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b931af-e6e7-4a5b-8a77-0cb6ba3c56d9", "sighting_of_ref": "indicator--9edab80c-92fc-4c2c-b6aa-62aaeec1bb58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07ef4b0f-0a65-435b-af9b-cbd90937ae3c", "sighting_of_ref": "indicator--4440fe84-f016-46ab-b84a-15e71929fdc7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af1d45d9-9e8b-4c12-ad89-db1d180c7659", "sighting_of_ref": "indicator--96c82ae1-054b-42be-b0fc-840df99f08c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81e4fa01-6b28-4afa-8a28-68d9f814f7e4", "sighting_of_ref": "indicator--1333e324-06ec-4a66-b51d-9b740a2fc601", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c797f3a-122d-4fb0-9878-42444cd06f06", "sighting_of_ref": "indicator--66eb516b-fd66-439b-9b15-71be30497848", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8544a2b-53ac-4fe3-9f4b-8bc25efc7801", "sighting_of_ref": "indicator--0e9a2bd9-58f6-432a-b1fa-28eeddd77da5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f19b1ed-059a-426b-a31e-d303ecff5179", "sighting_of_ref": "indicator--8d4fe527-7ab8-48f0-98d0-c6b80ed2ac7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f7d90f-8a30-476b-92e2-3b599e546889", "sighting_of_ref": "indicator--838df59f-8e5e-4428-9707-65e701505f01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91851ffa-9634-4cf0-9357-c656c1188dfc", "sighting_of_ref": "indicator--9d372c8c-4b78-4c5c-b771-6ad0c6be73cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2200f0e2-f131-4b3b-b6d6-3279fb2f3580", "sighting_of_ref": "indicator--d8b61704-f508-4719-a9da-69a79e52b1ab", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c7bf05-fd31-47a2-a31e-4cd5556d70b8", "sighting_of_ref": "indicator--3f3fc95b-2fb9-40bc-9d36-5e7b48fda064", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46894021-6af8-4ec6-a9b8-99d9d788cf7d", "sighting_of_ref": "indicator--85aa5284-c45a-4ce6-862d-f34b571076f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687647b8-a490-46b7-83f4-e2322bbc52b5", "sighting_of_ref": "indicator--9941316d-d11f-423d-af59-ccd8c74b9c5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ad33e0-7d1c-4896-a1b5-8e5fed5838b7", "sighting_of_ref": "indicator--7d894ba6-3085-4f7b-83eb-ec24ef1af9bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03a235b0-9133-404d-8a92-deedcdadc39e", "sighting_of_ref": "indicator--21407a89-598b-4a72-9876-01760e2ad5ae", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f91de388-18ae-481f-abf6-5d2e1c279d88", "sighting_of_ref": "indicator--52bbc9ec-b914-4441-9d32-739073af8ccb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87c1d9cb-4bb0-44c2-9162-5d8d4336718d", "sighting_of_ref": "indicator--5763b730-11f1-41a0-b023-e0ee78351e90", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--676cfa4c-5da7-4cf3-a594-1cd27fe07f04", "sighting_of_ref": "indicator--211caf30-b809-41f2-947b-f6dd30026e5f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6808644-0e27-4ac8-bea5-5f48c538c22f", "sighting_of_ref": "indicator--3786b54b-20a2-41ef-aba8-43a4a42f4754", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc8e8849-d4e8-479a-acb6-29474b5fd372", "sighting_of_ref": "indicator--aa5c9b80-9a90-4516-97e6-be1fc167a1c3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69816b2a-e56e-44db-89f0-d917b63bd451", "sighting_of_ref": "indicator--5bac1dff-2e4f-4724-bce7-51e011e54ebe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fc1ba4c-88a7-42e4-9eb2-67bd2876a00a", "sighting_of_ref": "indicator--706f7a4f-ef08-452f-8833-0d2b2354e387", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d0d5f5-d468-4c1a-98c4-7c8128372671", "sighting_of_ref": "indicator--09efbdf0-9a08-4a2c-9979-314fec264ee4", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955cd344-e2e4-4805-9c35-8d2d65d7b2ba", "sighting_of_ref": "indicator--df2fb75c-873c-413e-8c68-22b5876df864", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24c8fcf5-ac84-424e-8847-a1e97e5bce62", "sighting_of_ref": "indicator--9a5c9ab9-58c3-4331-8d43-186ee8258097", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f776dff0-8551-4262-8685-2481297dc550", "sighting_of_ref": "indicator--3bf55046-8a6f-4bd9-9d0a-aaf07a16355e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3062aa8c-c277-4af6-b0db-5cb53bfe6c8e", "sighting_of_ref": "indicator--8188fb42-624d-4a8e-b000-6414ecbd2975", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--628fb635-8726-4525-8ee5-efedf0901bb6", "sighting_of_ref": "indicator--9b39190d-64ea-462b-8de9-fb388fe14119", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755a97ca-5a92-4285-ae32-96f73d3c2f15", "sighting_of_ref": "indicator--049862d0-96da-4aa0-b89c-3a6a278fdbb8", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28d91f81-eee6-4019-880c-cf9d8aabcfaa", "sighting_of_ref": "indicator--8f713cb8-1ce2-4062-b4a7-e42023687e34", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9959e05c-2f60-4b4e-a329-c51031f84e0e", "sighting_of_ref": "indicator--796b43a8-591d-42ed-8ce1-90fd9eb9575d", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b45b76c3-6d02-46b8-9ee8-6dd61b5d6aa4", "sighting_of_ref": "indicator--77224eb2-93b4-498d-a9de-f07d57642108", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--674a740f-451e-4f8b-bd15-091c96860ba7", "sighting_of_ref": "indicator--fdf0df90-c5c0-4494-a47c-733ef1be49e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb52a0b-827f-456b-96e6-b3a4c8329624", "sighting_of_ref": "indicator--3fdc5561-d2c6-4561-9953-5e5cab71e148", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb3e94f-ae6b-4101-9eba-3d4146e650cb", "sighting_of_ref": "indicator--b99d1a3d-6c89-4ef0-bca8-aa2620042825", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--758961b6-6593-4f76-b00e-c209c04cb020", "sighting_of_ref": "indicator--f60e3600-4098-4cc8-a1ad-5d458adda1b4", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff7675a-7db0-4a4d-961a-792e6ba54956", "sighting_of_ref": "indicator--bf29fa62-6f5b-4bd2-a3dc-6762c6951fa0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dfa087f-d166-46a3-b80c-ed587d01d8ab", "sighting_of_ref": "indicator--d54d3d69-1a47-417c-8c07-a7decb51baf1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beebfbb5-1f46-41d8-b242-6e07bf5d1d15", "sighting_of_ref": "indicator--32066378-bed3-4fbf-b9fb-b44336ba4024", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--979fb03b-18fb-4077-9512-999960df4e81", "sighting_of_ref": "indicator--74ed5e6d-5008-46bf-a5a7-959ce7aa8065", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2bf948e-6b09-4458-b5a1-d8a28d19c364", "sighting_of_ref": "indicator--fde3c00f-8e2d-45ce-bc2d-ef92975cfadd", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f92b1afe-17eb-4cdc-b251-555bdf083c0e", "sighting_of_ref": "indicator--fde3c00f-8e2d-45ce-bc2d-ef92975cfadd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0676faf9-6b81-43fe-af7a-138b9892cf60", "sighting_of_ref": "indicator--dc634a1f-fede-4062-88f0-6f248d16edce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ebf8950-a0e7-4ae9-bb29-e08127a7c057", "sighting_of_ref": "indicator--9ee737b2-d9cf-4b26-8cdd-56d4c84b4adc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2c4f086-6416-465f-a343-d251cad72d5b", "sighting_of_ref": "indicator--5cd5d277-bb26-45e1-990e-f97610040e6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e70752-b82b-4bef-83e4-1202472c4ca4", "sighting_of_ref": "indicator--62399a1b-02ea-4010-8e89-c27ccf364b99", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a28946d5-d828-4b80-8d75-0e92f821021c", "sighting_of_ref": "indicator--3de216a5-6bef-4cd9-8617-434228e63086", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15593f5b-a927-4dcc-858a-38b8df0613a8", "sighting_of_ref": "indicator--02b0227f-e8e4-4039-a072-5f73e3fbf486", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3bef184-3a1e-4c0a-9ad8-d60ece078189", "sighting_of_ref": "indicator--3f16abaf-7202-47e2-8534-6fc76f016ca2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e773a280-9c32-4034-a839-55c29676ec0a", "sighting_of_ref": "indicator--5d203bdd-1f87-481a-aa39-0a5760aac2e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24238649-f0cf-446a-a4dd-f19ad82601d7", "sighting_of_ref": "indicator--3d7539ef-2812-43c3-916b-2903dfd635db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b74ebda-51cc-47b7-b318-ecd316e0f1b6", "sighting_of_ref": "indicator--0fafe4f2-f409-41ff-8829-5290a570d7b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d0d11f-afbb-4972-bb93-a43658fee58f", "sighting_of_ref": "indicator--cc682615-ff8a-4d79-a50e-cd33ceae08b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17d24810-5d78-4f47-9d07-a495857ef093", "sighting_of_ref": "indicator--d2adb4ba-b9e6-4866-93e3-fa33358e6b80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0447b05c-a983-4d0e-b5e0-1e2e6d67a765", "sighting_of_ref": "indicator--74b6992e-a1a5-4ef9-98b0-003df6780bbb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55eb7d65-2465-4947-84a2-81ec5e169664", "sighting_of_ref": "indicator--3d902b18-7596-4448-84f7-b40d1de7e61b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8088ec5c-e2f9-4ca8-a028-9757b34fbb66", "sighting_of_ref": "indicator--d76faedb-1fad-47fa-b82b-fb1818413cd6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64de4a74-a247-4ba9-a455-284376866bd1", "sighting_of_ref": "indicator--a268cebc-014d-49b0-9a30-3c06a9c73698", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a2ac99b-1693-426d-8efb-15dde2baaf0f", "sighting_of_ref": "indicator--32e96718-147e-4532-9032-888c6c9a15be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29624dd0-9396-4ff2-b050-a565556319c6", "sighting_of_ref": "indicator--6ceed244-d64e-4c4f-9741-3793cd2540a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c28766a7-5870-4f4e-a9e2-ce1cbbd97a4a", "sighting_of_ref": "indicator--3d474c58-d848-404f-b41a-a8fbc6167d72", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea894b22-d793-4ed0-a558-3fcef0a74beb", "sighting_of_ref": "indicator--f4348a82-fe26-418f-907f-481e4b14d5e0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c8cf34-3ef7-4ed6-89c7-80be7f60d78d", "sighting_of_ref": "indicator--13a19818-c440-4925-8838-a2edb8697e40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d96f8d7-f27d-4f4b-b006-7ea82fca77cc", "sighting_of_ref": "indicator--fd2363a9-9c07-4e32-955e-b2b0a5306e8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0f2da2-089e-4866-8b43-1ae01985bdfb", "sighting_of_ref": "indicator--12e518c8-1aab-44b7-816f-e0df2e95ac25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7817fe8-195a-4291-a800-cfc8f06ac83b", "sighting_of_ref": "indicator--4e61ad3d-5ea0-4d3c-a307-4f67e7dcb970", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb5e5b1d-ea17-44cf-82db-0488018c9e10", "sighting_of_ref": "indicator--1475d1bf-fc05-438b-950e-e2100da71181", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e5649bf-31e3-4fb3-82d4-233d9d016417", "sighting_of_ref": "indicator--ec752390-6ee3-4775-8186-3fd61b594414", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db5f40a-4a31-4156-a7e6-f0ff39819127", "sighting_of_ref": "indicator--79b2d083-d64c-4a98-a6ef-2d1adc6d6475", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b631f0d1-b8a2-475f-baf4-3ef4ba42c810", "sighting_of_ref": "indicator--35e2675b-7b16-466b-8388-38cc7fa5b08d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff26e93-576f-4312-bc4e-f08b1b6d9c15", "sighting_of_ref": "indicator--308aca54-1010-497d-b5c8-70a6d1361144", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--456c219b-8ae5-4843-936b-6e8c93fd327d", "sighting_of_ref": "indicator--36d2289c-3286-4c51-8783-97119c4bbad1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef33df12-ef24-472c-8e3d-bebbde7508f1", "sighting_of_ref": "indicator--1f1bbd65-8480-4d86-ba60-3679f3710457", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--166cb390-1352-41bb-a4ca-f7a287f75626", "sighting_of_ref": "indicator--3b213db4-7bd3-4fcc-a6b2-241cc0d6d483", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117bbd42-771f-45fa-9025-22510994a629", "sighting_of_ref": "indicator--2ce89545-be47-4c39-8d37-6f74a042b49f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b23ecc1c-bf67-4e5f-94f1-c618f767bb54", "sighting_of_ref": "indicator--e187e113-a83d-4c1c-82f4-cbbd383d3c10", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23cfa0be-f5ac-4734-b3b4-0f0125572386", "sighting_of_ref": "indicator--30d71137-1ca1-405a-9e66-b0288d318a55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a8386dd-f25b-4b32-be1c-2cdbd86bcf9c", "sighting_of_ref": "indicator--ecb63cd5-4b47-4e1e-882c-6e92f095e7dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a64f0245-554c-4ac7-bc11-b4a05c258138", "sighting_of_ref": "indicator--eb0db6b6-e6ac-49cc-9b09-dba0e192a02a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95ee9e23-120a-4c6a-a842-33eab14c5356", "sighting_of_ref": "indicator--785b0167-81d4-404f-8cd9-973c9adeea8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62358286-fdd7-409f-902f-bc0654c6625d", "sighting_of_ref": "indicator--3c5178c9-050f-422b-bd7f-30a6cb184449", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e453a90-e09b-4cf2-8221-6226082ae5a7", "sighting_of_ref": "indicator--cb149f99-c30c-421f-b026-a3776256f3f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201fe6c8-0ee5-4e10-aeab-a7782abc5227", "sighting_of_ref": "indicator--428391bf-9cc2-4a4f-8443-0138e5ae5e25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2309be9-e34f-4bf2-aa78-e3b34c85484e", "sighting_of_ref": "indicator--221d40b4-4e2c-4417-a107-b4efd7a79ffb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd275ff5-e93d-4068-aa26-b9ec1abfb5c0", "sighting_of_ref": "indicator--37aabb01-7806-4e7c-9df3-2bb2a762d566", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2956dbc-d8a2-40ba-b91d-0a032338a656", "sighting_of_ref": "indicator--490c283f-0ffc-4c6d-85ce-45bfb0a94c1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61a9e5e6-8096-40e2-99dd-4d9c059dbc58", "sighting_of_ref": "indicator--20230f92-2f25-4dc8-850d-0de66d7ab759", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11d4d7bf-9fbe-4478-afba-751393e70fe5", "sighting_of_ref": "indicator--49dcb966-f4b1-4706-bc20-2a0186a39d02", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4312e1-123f-4bf6-b13b-098d06addc54", "sighting_of_ref": "indicator--2bdcab51-40f2-48af-b9ec-74e21b680492", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c140e85-5da6-45a5-b686-4b346402bf23", "sighting_of_ref": "indicator--ec3e2746-764a-4e9c-97a7-5861a4a15df0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dffbe2d8-06ef-43f7-8450-287791498a72", "sighting_of_ref": "indicator--380985a4-ad76-48cf-9249-728a6437e2b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd9dede8-ef70-4874-8d98-08b87a98338d", "sighting_of_ref": "indicator--cb7b9c44-4455-4017-866b-99f1f9919814", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7517751e-22d9-40ef-b410-e2028c564695", "sighting_of_ref": "indicator--84bbc54d-4789-43d0-acad-67fdbc9c17d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed99451-6ec7-4fda-b6ef-3b358fcabaf2", "sighting_of_ref": "indicator--1a88e238-e9d9-45fd-8b76-cc69d083f701", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3fa841b-3191-4a79-820b-1aa893291200", "sighting_of_ref": "indicator--0dc8e00e-5362-43af-b0e6-550a7772d76c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb8acb7-ae35-4af1-b486-defcdbdf3df6", "sighting_of_ref": "indicator--7d07b728-0c0e-4c73-9975-853ee11b293d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a5a70f-b42e-4d09-a496-0a3539c8cbb5", "sighting_of_ref": "indicator--4366ed00-e6b0-4ba3-9350-1386f9ea8f35", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e626391c-4fc6-4fbf-884e-9916971a830a", "sighting_of_ref": "indicator--e686b674-fa2c-41f8-b04b-14536571ee99", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85d9dd56-483d-4ca1-ae55-89e5f23ca6b5", "sighting_of_ref": "indicator--0b4e1665-921c-41a3-9fb6-3a9a67f0513d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70aa43e9-7b43-4da6-b525-5110dcf89fb2", "sighting_of_ref": "indicator--08658c02-7185-4fd0-b20c-63ca69e7a790", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20a4ad5a-bef8-4b8d-8476-55832a17f59f", "sighting_of_ref": "indicator--22b09baa-ddb0-48d1-a207-f078bb594d2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d94022b7-0da6-41c0-92e8-1013b06df2b4", "sighting_of_ref": "indicator--7dbae92a-9f05-4504-97ee-9b08c3932b69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8314ae19-4cb0-4ea7-8112-13dd3c05880d", "sighting_of_ref": "indicator--792cc680-061b-4faa-87c5-ad74c1ebe2ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50818fbf-8c2c-43eb-95ea-ad547167c408", "sighting_of_ref": "indicator--4cae7f6e-f6c1-4a9c-8321-ed6ed7f1359e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2490e038-e442-4f79-8365-0eb3f8c41bc0", "sighting_of_ref": "indicator--93f9247f-3e34-42f1-a2d6-4ff5a8c08df6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ecb26ad-52ad-401d-b3c6-c31a99529067", "sighting_of_ref": "indicator--fdb2e9b7-a354-432e-a4b5-83a7cb37015e", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cecb2a3-486b-42f4-ac5e-62a163dfae01", "sighting_of_ref": "indicator--ca61a6a5-9767-47c7-b490-143a54875568", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66960b1f-aa92-40ac-a7d8-1a5170d1078f", "sighting_of_ref": "indicator--09d3db4c-1101-4e5d-a1e3-60fe55f2240e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a63f141-ed48-4f5e-8c70-9ddfdfefa86f", "sighting_of_ref": "indicator--4027468a-0eda-44e1-a373-3f364427ca96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18ff840-adf5-4d42-8522-7bf191c471ef", "sighting_of_ref": "indicator--7aa622a8-dde8-416c-baf4-cacfdd123ff7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36479cec-17e0-4707-925e-aa114487a93f", "sighting_of_ref": "indicator--8893e781-d0a3-40c5-851e-e6343c46236e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22fede45-bd81-41f0-8cd4-8e712531572d", "sighting_of_ref": "indicator--0c847620-ef1c-4f1c-9252-4754496c6ea2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--854573d9-e09e-471e-ade2-d343a09fc838", "sighting_of_ref": "indicator--cc2bd741-3971-46ef-a550-d2dace65268b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5578719-8296-462e-a6ec-8d78f977b70c", "sighting_of_ref": "indicator--18b57398-bc0f-4907-8675-2cc849cb5c15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d97cf6a2-6cd0-4c7c-af68-5a7641f9017b", "sighting_of_ref": "indicator--651b59e6-aadc-4ff4-9378-ef11ad93fd3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5662c9d5-d1a4-48d3-aeaf-bc7389e5e014", "sighting_of_ref": "indicator--1245ffba-fa47-48d0-bb24-d656ce268c24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293d9118-05d4-4b74-a2b8-ebf6db6b210c", "sighting_of_ref": "indicator--e7d30c92-5940-4cce-857d-2d273d779600", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dc8b7e7-8633-4387-afa3-47e0ce37ce14", "sighting_of_ref": "indicator--bec1f822-896b-43f7-961b-7f83b73c511f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6e18ab-481c-4829-88dd-b96936f9629e", "sighting_of_ref": "indicator--e5c29340-a116-4bd2-92a3-85a8bf20b60e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9099a83-3e2d-428e-b70e-b2e02e825912", "sighting_of_ref": "indicator--adfbc9ed-01be-419d-accf-a0aa8ac81ea2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--479b16de-bed6-4edd-8767-48427f5d3b0c", "sighting_of_ref": "indicator--add0847c-495c-4ced-904f-b1ee9c01037b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5127f41c-0190-4a86-b51f-96dd4c4c3dcc", "sighting_of_ref": "indicator--152c5abb-e52b-4323-a319-b96ed8f48159", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63771838-746f-4d2e-abb6-2399bc706c2e", "sighting_of_ref": "indicator--ef0017ae-4002-4dfc-95c4-6e9a879d4406", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16d3bcfd-fceb-475f-97ac-857b522ad3f2", "sighting_of_ref": "indicator--cf6caed7-81cd-4e65-b78e-98722ac75538", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e09ebb-f667-474c-839d-6b1b049587da", "sighting_of_ref": "indicator--93a365dc-d339-4be3-87c8-8bfde7a36dee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a1153f-36da-4c62-953f-65cbf3676892", "sighting_of_ref": "indicator--081fb8c5-d14a-419c-aa02-2f027dcc56a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a818058b-7feb-4381-8f19-c2ea56d6174c", "sighting_of_ref": "indicator--858f8e8e-a80b-4661-8004-de33e975f46e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d0c807-5a9f-4109-98d0-99e5c045eaaa", "sighting_of_ref": "indicator--b8a66d17-9329-476b-8b81-4c7e1b46e21e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f527422e-8e20-4c8c-9367-94f83a3d6a24", "sighting_of_ref": "indicator--6938c1e7-e945-420c-a7bc-f47e214f42dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70974503-aa4a-42ae-a53f-1ff58a5df2ff", "sighting_of_ref": "indicator--e514413e-2a30-43e9-8d91-2fa41ac9d403", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5aa306-c8ca-49df-8c36-8b3c91f17c37", "sighting_of_ref": "indicator--9ce5b7f8-21d7-4bf3-8d66-c4a1130cb508", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3edca72-a232-447b-9ff9-76e357dee2c7", "sighting_of_ref": "indicator--616faa88-af46-4e37-a724-c621b77477e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e303289-e8c3-443b-99c1-976810978327", "sighting_of_ref": "indicator--9b64e367-ed6c-492a-ae12-b64f2c9d2079", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6012611-66fb-4e0d-a214-e5e2418c9f13", "sighting_of_ref": "indicator--d8e31948-7956-45ad-bf8e-7c324cad84a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--384a2102-91b6-458d-b7ba-be479a547dfc", "sighting_of_ref": "indicator--9c1235f6-f821-4061-a46c-abb07ab9982b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00c4332d-85c7-4e1a-a88e-70facbdaaf66", "sighting_of_ref": "indicator--58800114-52ff-4fa5-9eac-4c8cf213a859", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce27880f-898f-4a35-8f88-c02929e9c03d", "sighting_of_ref": "indicator--0922030e-4fcb-4182-a636-ca9c95a24ec0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c135c6-937a-46e7-a669-88715fb5de73", "sighting_of_ref": "indicator--7c4465cc-af72-4159-adac-c8e5dab51ef9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a844a7a-3b61-4358-8794-d89cb7b0a627", "sighting_of_ref": "indicator--6665b11f-d303-41d0-b374-9129dbc43e3b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47e863f0-6c5d-429b-a54f-413e126f00a5", "sighting_of_ref": "indicator--6e29e91f-4dde-4535-83e4-9801b15ed977", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c8b8e14-58a6-4ad8-9834-eb255506d350", "sighting_of_ref": "indicator--be56b8b1-76eb-4add-a323-8ec473e703bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc4c38b3-7a07-4ddd-898a-e151b9687b99", "sighting_of_ref": "indicator--69500040-7b63-404a-a6ff-2dc9918182ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--377449b4-2739-4a30-b897-2c140d589789", "sighting_of_ref": "indicator--41087110-7c20-4148-9549-d60a20a511c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccbf2fe2-49cc-4110-9f28-7a207f54ac20", "sighting_of_ref": "indicator--1eda582e-57f4-49ae-affd-7922b60f56a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2de38117-ae81-4762-8b3c-1525f01a30ab", "sighting_of_ref": "indicator--27490e5d-c9bc-44cd-86ef-097bf078796a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e034ad9-0d7f-458c-8f3f-4cd8be1081e7", "sighting_of_ref": "indicator--44c9d0d0-10b0-4ae8-a704-5ef5de903d7c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1d3b0a9-67e0-4c76-96f9-e2249d3baf3c", "sighting_of_ref": "indicator--658b3d73-efdb-4785-8ce1-5d59486adc93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7c69e38-f50d-4b43-9b5e-f269451894ea", "sighting_of_ref": "indicator--f3f50ceb-3ed4-421a-80b4-723c32a47cb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c41f5e-85d1-4017-be88-1ed85a3e0c9c", "sighting_of_ref": "indicator--b80c1ee2-79d6-4c5e-a20f-a51c3360ec7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c6ff387-a834-4edf-9f17-76b5f2b49f2a", "sighting_of_ref": "indicator--daa5b9fe-5c69-4879-ab75-365a0827cb2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51bc84fe-3c1f-406f-accd-9aed43a3e46b", "sighting_of_ref": "indicator--9741d190-458c-417b-a182-b72716cf7b78", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2caf06f-01da-4ad0-bfde-64310f04cccf", "sighting_of_ref": "indicator--21281290-7132-43f8-9bd5-590e047cebee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--652ed85a-8875-4e83-b258-a75092d49507", "sighting_of_ref": "indicator--166bb508-6b45-4c02-a039-ea8a642ac971", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74d78449-28cd-41b5-838e-4c804fd468ee", "sighting_of_ref": "indicator--f33a7dcf-81ee-463c-975b-9f541f11f2a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5422e204-d3b9-43c5-8af9-0f7d17b701a2", "sighting_of_ref": "indicator--ab516694-0071-4a0c-bcd9-fa3ae4a94317", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--121ae293-1bcc-473f-a979-5b83f410c4cf", "sighting_of_ref": "indicator--4e0ff2a9-3efc-479d-9ee6-425806265086", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96a49d7c-1a97-41fc-8b17-4822522df58e", "sighting_of_ref": "indicator--e3f2914c-530f-4416-a63a-d5d800b666e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdc90a65-81dd-40a3-9865-8b264284f4af", "sighting_of_ref": "indicator--504efadc-5321-4a0a-bb42-5ac72578801d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a43877a-78ed-4f98-ba16-a301387fc748", "sighting_of_ref": "indicator--5905d27d-eb54-4f2b-bd28-908de69e3cd1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06f6080a-cbbd-496a-888e-3064af8b20cd", "sighting_of_ref": "indicator--60cfa017-a5bd-4f28-adaf-b06dc1b6a65c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b501b2ec-9e64-478c-ba32-0d458f13b67a", "sighting_of_ref": "indicator--504e9f28-c1bd-4bb8-9e03-c96d27d27168", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b2be006-1831-4e22-932e-d84466b03154", "sighting_of_ref": "indicator--20f65f93-b030-4ec6-a163-9fb253c12369", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c9d7205-93b2-4111-9745-8ac85e030522", "sighting_of_ref": "indicator--0a817d14-89b4-4f01-9e73-29f80a7c63f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a45689-5486-4478-a864-d9389965f3f4", "sighting_of_ref": "indicator--207ea854-694e-4a09-a481-88021eb23cd9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e985863-8e65-4020-bcc4-6c4e97998a7f", "sighting_of_ref": "indicator--27b08103-9ecc-4971-a8e2-2b3b1c1b90d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a464a778-d65d-4e70-987c-88deb0100cc5", "sighting_of_ref": "indicator--e53397cd-bda2-4955-830c-e6486bae4dd3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67432cd1-2815-4b48-8695-3afabb624422", "sighting_of_ref": "indicator--e6e79ff0-2845-407b-ba13-612e744c1493", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5a4e3d-66fe-42df-83f4-971085af4544", "sighting_of_ref": "indicator--3f336d86-2968-4b3e-ae51-27b72597d071", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fee7675-6718-4743-8690-ae03969db84c", "sighting_of_ref": "indicator--3300d36f-ff18-4b9c-b440-169f0976163f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d632704-0372-4316-ba6e-852120e60276", "sighting_of_ref": "indicator--9f608482-5b2e-496f-9bda-0766e9a89eb4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59d8fd08-d43b-4527-9a03-09885372ee3d", "sighting_of_ref": "indicator--fa4b5d24-2101-48bd-8722-3fa84f889b58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c4c7e1b-899a-49ed-a7a3-b9af2bae3661", "sighting_of_ref": "indicator--03d8de62-7912-4f11-8cc0-57474e201467", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954968ec-0bf0-41be-99bf-647d29309009", "sighting_of_ref": "indicator--cf1922e2-73b7-47d1-9be5-25a515a7fe77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79fc3c3b-1b4b-4744-bbe0-7e16a238a988", "sighting_of_ref": "indicator--cdb115c4-ddd4-4c28-87f5-6321f00beeec", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e590d83b-6f83-4c6c-9b19-9a3caa0a7b93", "sighting_of_ref": "indicator--6b28bd46-afea-40c2-8bdb-745af2470b51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf3b7589-a41e-44cb-9faa-3f2efc96f686", "sighting_of_ref": "indicator--82f57975-d48f-46f0-a15c-38d9fb0e8caf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c41e56-b863-4055-9be1-c27667d7659f", "sighting_of_ref": "indicator--579dc960-858f-4328-a463-d7d4712e6d4f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edf92575-e105-48f1-ac55-04a78b6cb8e4", "sighting_of_ref": "indicator--8d1b20b7-d712-4bcc-8f24-68ad60f046d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f94cd72-388b-4a4a-bea6-2c4de6f6dc26", "sighting_of_ref": "indicator--94dd65b9-4c20-46fd-a432-08576ec34502", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb5d8dfd-f053-45e2-958b-f644f351b4cd", "sighting_of_ref": "indicator--d183248f-0350-461c-8c58-8dfde4a4e158", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6cf5e99-0640-4dcf-86da-2da9c90d9df3", "sighting_of_ref": "indicator--f371ad99-9d08-4cc2-8cf8-0392b770dfe2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c756bfa8-a034-4853-ae2a-45d8eb1cde15", "sighting_of_ref": "indicator--267f96bf-7920-46f1-a0a0-e6ab540aae32", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f237aada-c358-4774-b93d-3f405ba4a27a", "sighting_of_ref": "indicator--152a7cda-088f-47d3-92a0-64945a07919a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd1c8199-8bb6-4949-bfaf-a8f63c7a58f2", "sighting_of_ref": "indicator--700dffd3-da88-44e0-978e-ada3bf1de102", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e4dabb-69bc-452d-b5b2-92b352f40149", "sighting_of_ref": "indicator--993bd552-5b37-4349-92c4-12d0ff6d3d0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ab7eea-6314-4ed5-83c2-749409df8c30", "sighting_of_ref": "indicator--e4a2c1b2-8e52-400f-8a1e-a760c909a50e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a41480d-3b33-4005-bd69-ab22f37812e3", "sighting_of_ref": "indicator--e652e50a-a750-4c27-9d64-0629386e9b15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb29342c-c41b-44bf-b6e9-4d043d4341d5", "sighting_of_ref": "indicator--1cda9a93-8711-4645-bb9c-1c3939e84903", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8f105ce-75f9-4030-9718-704e1cece712", "sighting_of_ref": "indicator--75e31eea-f191-4621-8f69-cc200870b25a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44f71681-f5bd-411c-9641-25db98eac1f3", "sighting_of_ref": "indicator--50b44c04-b234-4cc0-8e5e-a1b01cc87db9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f1b225-cf2d-44d7-a64d-208f5d0618a3", "sighting_of_ref": "indicator--304f9d52-ceb2-4c87-8a22-0aa068976557", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954fc90e-3cdb-446a-bbbd-94c323a0d470", "sighting_of_ref": "indicator--304f9d52-ceb2-4c87-8a22-0aa068976557", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd254ceb-d966-4096-96f1-dc48e2c8d6e8", "sighting_of_ref": "indicator--f168af9a-592c-426d-8e85-0c330485af87", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b2816db-2f00-4014-8331-9ad70b17f745", "sighting_of_ref": "indicator--6f237d2d-1d38-407f-954f-0b919e839f2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0056f8a1-45de-4ce6-91ff-57bf85ce6eb1", "sighting_of_ref": "indicator--45c43e16-d457-4766-97c0-1e219f5be15a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f83611-7fff-4871-8ffc-7cdfb8357ed4", "sighting_of_ref": "indicator--f2bf06c1-a9ad-4c29-bd76-9e9170bf3c55", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--946d2daf-9578-4cc4-bbc0-40e70793fd2b", "sighting_of_ref": "indicator--cb22a400-7a4d-48ed-b8e7-ad9e21292e96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c20f169a-12a8-49ca-bff9-ce1eda559e42", "sighting_of_ref": "indicator--6812a4ed-f1bd-4838-a72c-d0ad2f5f16fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1cabdd-2c06-4bf9-99cd-979b82c4f3b0", "sighting_of_ref": "indicator--d6275e6e-3180-4bd5-80e4-c02dfd82baea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4736137a-56ad-41bc-ba05-771935273ab3", "sighting_of_ref": "indicator--b8e87780-37b2-40d5-ad47-ec5279cff1ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93a9087-8955-4fa7-953a-a16dd62f2cd7", "sighting_of_ref": "indicator--e6c55d7a-6173-430e-b124-7ac422b97d8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3adfae4-0183-49bc-a429-06d435008f0b", "sighting_of_ref": "indicator--7abf6f11-fb0f-4f34-9cc8-9dcc8f47427e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9b007d0-a6fb-46cc-9bfa-e9ecf75b31d6", "sighting_of_ref": "indicator--9311458c-b62c-4597-90f5-f2e09aa75882", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f0003c1-2066-40bc-b156-a1d0d4d0ddd0", "sighting_of_ref": "indicator--bdf74c52-1ea3-48d0-ab04-c9803bd5be5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e27a3ec-cab0-483e-8d8c-6c0ee8e8891f", "sighting_of_ref": "indicator--cf9001c9-3ee1-4e20-93d3-5865a639bb38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c173c88c-1c28-4284-9b56-b5c7109f932b", "sighting_of_ref": "indicator--4bae680a-f97d-4063-a677-df930034a73b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9c7505-ff95-4873-aa93-3e36af5bd380", "sighting_of_ref": "indicator--3850b991-f10e-4388-95c3-55e04f626b42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ada864b-f831-4d96-b01d-22ca0c83c4c7", "sighting_of_ref": "indicator--f7534a61-dd41-496f-bce0-102a7195144c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b3e2dc-12e9-40a7-96ae-a96f98a07221", "sighting_of_ref": "indicator--36184c29-0dba-4682-9963-4c83e30e876a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6578124d-ec31-4e14-99ae-fa1e25d1088d", "sighting_of_ref": "indicator--8ee74b8a-093b-4f78-9ba5-2899cfd499e5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdfd3f25-0e44-4b76-baad-365becc9fbc0", "sighting_of_ref": "indicator--b9240a4d-bc85-4198-b988-e758799fe49c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8f87c7-d6b0-4da2-a68a-041080e21f55", "sighting_of_ref": "indicator--6ba858f4-9131-48ad-b878-69187e680831", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71fdf44c-6b8e-42db-969d-cd149d0fa662", "sighting_of_ref": "indicator--e4cc8235-5b11-421f-9c5c-dc1ae37bdafc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecead62e-adfd-4df7-bf26-85de5ead4cd1", "sighting_of_ref": "indicator--4151a67e-e224-4078-a668-4e28e248e1b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee6e6f6a-9885-48e7-9838-16414d81ff3e", "sighting_of_ref": "indicator--301c90aa-e322-4549-a7ee-d09ed38f0a6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db4be693-ce75-4acd-a3dc-ff05c32b2323", "sighting_of_ref": "indicator--af62efeb-05d8-4d8b-b416-048fb966ad84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6644b64-3ba5-4615-9059-851447f439a4", "sighting_of_ref": "indicator--37c3787c-9300-44ed-868c-ed8c0054e87a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6206446c-72ff-4d62-a1d8-96eae2bf812e", "sighting_of_ref": "indicator--9c914881-a255-44a0-ab11-9ec44104f21f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1006c6c6-3ade-4f96-8f2f-95afec6b5868", "sighting_of_ref": "indicator--b0be609a-4b85-46fb-a248-3ab998465d7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--526d2fab-bc37-48b0-88f4-ab916e298f11", "sighting_of_ref": "indicator--24863497-bddd-4180-bcf5-723fedfffdd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e5624fd-f760-40d2-89b6-7c721c4f80da", "sighting_of_ref": "indicator--fde6242d-363a-4246-bf8d-89f0b751cd60", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd81ad0-55c0-4690-89ae-07d0f22acbbc", "sighting_of_ref": "indicator--f84ab653-50c6-4373-bd60-f0cd073f01fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2707641d-f118-4a43-911e-5c48fd0f5dcf", "sighting_of_ref": "indicator--658860c7-d523-4a5b-94a7-f0c27e8a0a39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2baa576-b0c3-4630-baf9-8737c1cf736f", "sighting_of_ref": "indicator--529e08bb-ce72-474e-82ea-ed30d9930c2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a03d7551-bccd-457d-b4fb-8f47a0865c4e", "sighting_of_ref": "indicator--99ff1d1f-feb9-47df-ac8e-7e28c718024d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cabeffd2-545b-4f66-a987-74b744508573", "sighting_of_ref": "indicator--eaf7924d-a319-4820-a024-9e9c7d9a4e80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ffdc2b-edaa-4752-a05d-de5f9a6e4129", "sighting_of_ref": "indicator--85f5a7bd-85e5-41ef-8fef-d846fcf11b67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41fd2c5e-97a5-47b2-849e-7ffdc38794b7", "sighting_of_ref": "indicator--a3c7c2d0-49b0-44cf-8fac-3c6faaeb0d04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6daa16e-dc7e-4849-bd9a-080d9e9582e2", "sighting_of_ref": "indicator--24e1246d-ec12-435f-ba2a-5f1f62af84a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d7179aa-96cb-47da-a359-dda8d13ab247", "sighting_of_ref": "indicator--be5994e4-7da5-4aae-9f14-f0b16a80ab36", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d036c3c2-7100-4535-b340-425887949881", "sighting_of_ref": "indicator--813f9ceb-a55b-447e-8200-976d79c07128", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64177320-0ee8-4ccb-9507-b0b95b36e4cc", "sighting_of_ref": "indicator--6c107598-dd62-489f-9b17-2d18c45682ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efb7c1e1-754f-4c32-8805-053138ebfe1d", "sighting_of_ref": "indicator--6607e5fb-11e6-4fe3-ba74-022be42f182a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47958e52-8472-4503-9f49-415b604677e7", "sighting_of_ref": "indicator--ac9ec518-14d8-4b42-abe8-1b0293761ec0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1792fa25-64dd-4b9c-94f9-145f20055069", "sighting_of_ref": "indicator--5d0d833f-905e-4736-8305-9d056a3ce105", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39fe976c-8091-4fec-a559-a5eae047be75", "sighting_of_ref": "indicator--dca75c62-abf4-4d27-9b1f-91405d7e5186", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0936eec4-be3f-48a3-bc0f-e8258faf07b3", "sighting_of_ref": "indicator--11b598bd-e243-4af3-9f7f-8712a7aa6058", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56fa930b-675d-4182-bb5b-2aff52fda908", "sighting_of_ref": "indicator--89b3e7a5-5707-4ad0-88c7-999ae34af7b8", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5547cd94-d045-49da-af84-783d6419cac4", "sighting_of_ref": "indicator--e9a80f30-188c-4b49-858f-2189fa5477c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88457bca-b8ef-4747-848b-6d6cc25125a1", "sighting_of_ref": "indicator--e9a80f30-188c-4b49-858f-2189fa5477c7", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d37c2d0d-b227-4b9b-83d1-a362ec1115c6", "sighting_of_ref": "indicator--1489db71-69c9-4480-a1a6-38cbb76d5ddf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccdf15c8-805b-4837-ab99-c0627da9aec3", "sighting_of_ref": "indicator--11a1abeb-3b98-4293-9a59-bf407698e73a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da3a3466-a42e-4b24-9045-f7496c704805", "sighting_of_ref": "indicator--e211981f-a0ea-4241-94f0-80ba12f50f7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a505efd0-6205-4ffc-a16b-f5ce774a5b59", "sighting_of_ref": "indicator--97b1ceb4-49aa-4383-9ac2-457a8f37f563", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e52feb3-3d16-496b-8afb-cf3f84581102", "sighting_of_ref": "indicator--9acb1273-44f6-427d-b58f-16805b139ada", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6df6df9-3738-4994-b70a-66145f6e8d59", "sighting_of_ref": "indicator--408393c5-8709-4014-bd26-c89d12327c3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e0fb17f-6ffc-4aee-bff0-aee75b9a3751", "sighting_of_ref": "indicator--6b2bc0ee-f553-419b-83d3-4410834ac4d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6eb77a0-d412-4962-bc80-c6c89cbd291e", "sighting_of_ref": "indicator--308e501e-0784-43b4-b767-3e6130984390", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf122986-bdc5-4951-a794-12be2c39a1bf", "sighting_of_ref": "indicator--355321f6-4f79-4160-a2ef-d96b9dd15e62", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fd222a4-1e4d-4190-bf85-ea1cedf35ecc", "sighting_of_ref": "indicator--05daa6d4-7621-4e1c-aa2b-b43eb52054bf", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aaa7a49-f884-416f-a553-cca52e5c8a73", "sighting_of_ref": "indicator--89248e19-fe38-493c-bcd6-ce6e6378e544", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92484fdd-74db-45a5-bd22-727d1b0f0e3b", "sighting_of_ref": "indicator--59e92aa6-d407-4219-b12a-44ee72877245", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c2ea503-236f-4d1f-806f-65bcaa1e1633", "sighting_of_ref": "indicator--a3b81162-1ebb-4f30-b2f5-9b3f89254394", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da432bc2-d690-47e8-ac42-f903ec85d2ea", "sighting_of_ref": "indicator--50eb67c1-024a-4887-9025-8d86c1f806f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736a3ad4-777a-4080-a2bd-53ac31ee919b", "sighting_of_ref": "indicator--31f14d01-2c7f-4ef3-9d0d-2cb6ef41abad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3794253-ad6b-46f8-8e63-a723daa4a378", "sighting_of_ref": "indicator--21faa8a2-dcbf-4244-8059-240533304081", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828baeab-3d87-426e-85ec-de78c6de6007", "sighting_of_ref": "indicator--02144ca4-1f7e-47ea-9fa1-3e414a07d0c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82356e8c-ff89-4f01-a7e6-ca92dfeb2875", "sighting_of_ref": "indicator--d4c46588-0db2-4917-b909-9538419daeb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310a12bd-04f5-4728-b349-3f6589d9a4f3", "sighting_of_ref": "indicator--48344918-be7e-496f-8772-8495d5f005b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba9f09f-7949-4c36-854a-d2d0000ffbc8", "sighting_of_ref": "indicator--9a9925b0-bf09-44e9-89e4-def8871b3e05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--825a3b8f-5fb2-402a-9b6f-715e2571abb4", "sighting_of_ref": "indicator--2e01393f-a010-4a0e-8c92-9b8c35436591", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3084d03f-16a5-4ad6-abdd-b9629130f131", "sighting_of_ref": "indicator--dcd3f46b-ff20-43b0-9a34-a58c79f3e228", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15b9b555-1ef5-41e2-8a63-93720a89d4b8", "sighting_of_ref": "indicator--54198de5-1a8f-4b10-b62a-ec7703fadbb2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b95435c-69a1-4122-bb45-808f33aee677", "sighting_of_ref": "indicator--d1c7f87e-7d33-4c2f-a3f4-a5b2b9a76408", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe4de4b8-4c4e-4f13-97c2-703f7abfc88e", "sighting_of_ref": "indicator--eaf5c70e-d252-48d7-a5b5-693b9f678465", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8920568-d1bb-4286-8429-358c0bb749f5", "sighting_of_ref": "indicator--8144938e-1cb9-4151-a52b-261d4445a1ae", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c265ea72-70c8-4a2f-a7b9-4397d23d66b8", "sighting_of_ref": "indicator--df95a25d-cb72-4260-b490-9a690fe063b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1189c437-f113-462b-bd55-412f895d9eae", "sighting_of_ref": "indicator--df95a25d-cb72-4260-b490-9a690fe063b9", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--641ea9a9-546b-4c4f-a3eb-1d3e7f523b59", "sighting_of_ref": "indicator--37f1c7b1-05ad-48e6-9ad7-962e5bd99f06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb3d5aee-0a8e-4fcf-a6cc-6ffc17dfa05f", "sighting_of_ref": "indicator--4b8568a5-89fb-4a3e-89ba-42567f57afbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac889eb-ca29-4c95-8e9c-ef4fbc71b852", "sighting_of_ref": "indicator--dad43777-af85-40c6-91e3-a9c6c4906574", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a8ee47-399f-4f4b-9550-510bcf567727", "sighting_of_ref": "indicator--a0d5dfa2-6d4d-4c48-b01a-c50f76c6ad34", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6797929c-2c15-4803-885a-afb9dba73104", "sighting_of_ref": "indicator--f154f3b9-ca1c-4c04-806b-e257728e7467", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7b11270-3941-4ab8-abc6-3a9e8283a133", "sighting_of_ref": "indicator--c19b75f8-8884-4b43-8a03-7732b4863181", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e57d72-84a5-48f6-88ea-0711ed74d586", "sighting_of_ref": "indicator--4e480fee-9dff-437d-b391-21e8215d6e7b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3bbd53-db83-4586-92e2-c28a27720fc4", "sighting_of_ref": "indicator--ea3e7cea-f4f6-4620-9e6a-a981622c0097", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62bb492f-fb5f-44a3-85f2-665c438996b0", "sighting_of_ref": "indicator--6791861b-c246-4ac4-a4d0-8bb249ad63a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddf7d0bd-a62b-48fe-b8bd-53c3530c6c64", "sighting_of_ref": "indicator--1bb511ac-a705-42fe-8cea-5a8bcc80ddaa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6de8f2-4c82-495d-ac8e-ba6ab602466a", "sighting_of_ref": "indicator--2e759c74-ca6c-433b-be4b-78f11740da90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9368ecd3-0eea-4976-aa82-8fbcf3aff08d", "sighting_of_ref": "indicator--4904ca53-64bf-4128-9b67-232b8145c3c0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1221fa03-f7e3-4a77-b2c3-03bc29e77fd4", "sighting_of_ref": "indicator--d340449d-2dcd-4207-bd45-7ff6030e8fae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a328504-98af-4e20-a540-5fb46a099a6d", "sighting_of_ref": "indicator--01554135-0c50-4356-90d9-829edb27972b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ee8f5d-4ddd-4b92-9e7b-49d2dbe4e4d7", "sighting_of_ref": "indicator--01554135-0c50-4356-90d9-829edb27972b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6767cddc-c1e4-4281-97f5-55cef8f1f0cc", "sighting_of_ref": "indicator--b3d15c67-9601-4c39-8f0e-1b7fb8e024d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33da035c-6b7e-425f-b2b6-8a56f1bdc08c", "sighting_of_ref": "indicator--d20e8fab-8fe4-4c80-8f78-61b838068f62", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a3b55b1-55fe-4394-b9ee-bd974bec3843", "sighting_of_ref": "indicator--036622ac-a7d1-4b12-a423-60c8cc284264", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5ace41-bd2b-41f8-91cf-65b4472173c2", "sighting_of_ref": "indicator--a94e29f3-3373-497a-a177-c3305e34e274", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e45b897-ded9-4d20-b8c9-2747f4224e13", "sighting_of_ref": "indicator--fa8e6d01-e75d-441a-baa2-34e60331f7cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d47923bd-e669-48c3-a124-745b6e6eb721", "sighting_of_ref": "indicator--fa8e6d01-e75d-441a-baa2-34e60331f7cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--891f2382-2e69-4afe-b93f-0f79f86cee14", "sighting_of_ref": "indicator--b12b3cb8-3a3c-4327-92fd-051d3b872ccf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52117534-95ad-4639-ad13-aa0671408a1f", "sighting_of_ref": "indicator--c59756c6-f5a9-4ef5-ba47-561c1621917d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcdaf50c-4897-49d8-8da0-b36a71781a63", "sighting_of_ref": "indicator--da764e70-f03d-40f7-a36c-8b025bdfd9d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--372c9094-f7b1-404e-8adb-7b8317556e54", "sighting_of_ref": "indicator--189ea21c-7529-4a79-8185-1d44167d055f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--953a3ba5-f715-414a-b855-7f5a285ce663", "sighting_of_ref": "indicator--1c0d7c59-20d9-49f7-8e91-a837f94d47a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf521b2c-54e2-428d-b52f-2bafca37843a", "sighting_of_ref": "indicator--d914b292-1f2a-4e5b-aa13-6134bbc01cd8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff136fbf-2039-447f-8c3d-aa399997fb4f", "sighting_of_ref": "indicator--7ac94a4d-d719-432d-8ab5-ae3b85673ca2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1b9b29-e20f-49b9-88ff-d8b9c8e4629e", "sighting_of_ref": "indicator--032f9ff3-4a02-42d4-b434-7d4ada542c4b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1843f22a-5c9c-4779-9cc1-efb0b81312b6", "sighting_of_ref": "indicator--6930a087-e66a-4ab4-bbfe-364ef9e31920", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a5baf38-2585-49a6-808b-82ee4daf39dd", "sighting_of_ref": "indicator--4392bca8-7e69-42bb-b473-5d2564e162ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e0120c3-610a-4af3-a83a-2b9b7b07f1d1", "sighting_of_ref": "indicator--cd8d8f14-23fe-427d-8ce0-36cf89aeaf88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f59ea9-b3ae-49fd-8bea-5b1fb36a48a2", "sighting_of_ref": "indicator--a6e8441a-773c-45a9-a0ee-b346c2e5501c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe38f234-8ea4-4232-a71d-12d387503479", "sighting_of_ref": "indicator--87589342-19b0-4f5a-b3ed-684f0ffacc8d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--267f16eb-d225-45d8-84c5-6101fb691ffe", "sighting_of_ref": "indicator--1e0f114d-a774-424f-bb79-49cc5467fade", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9796a33c-80ef-49c7-8943-a616edfe081d", "sighting_of_ref": "indicator--337bd29a-c79a-4633-86c5-353e670afc05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2c17a4-fe92-4870-bfb6-b18218ad9ec2", "sighting_of_ref": "indicator--7e6381b9-d8b1-492d-84ec-677b23759208", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679d3305-8db1-4129-8e3e-a19a3ff78e7c", "sighting_of_ref": "indicator--2fcd095e-163f-4617-a525-b9f15c51beb5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--584878a4-8664-449a-9569-1b59fc5aa1fd", "sighting_of_ref": "indicator--bbb235dc-3382-4018-b32c-d337aaa9a190", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6775456c-9b75-48f2-9414-1063c1b39e89", "sighting_of_ref": "indicator--5e0e2a76-337c-457d-aa58-56483edea3dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1580326a-fc37-4fe8-9645-6d66bf766bfa", "sighting_of_ref": "indicator--f26c4cf8-5c5b-4316-a3de-0fe9c8a1a2a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda8c839-63ee-45de-bb72-5a6ff81e0de8", "sighting_of_ref": "indicator--f26c4cf8-5c5b-4316-a3de-0fe9c8a1a2a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bac8353b-4ed2-4f89-af26-28978b52a4a6", "sighting_of_ref": "indicator--89e0f43f-c380-4a4a-8572-89e75f6a86f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--081f8241-b244-42a7-9019-e4925d319ed2", "sighting_of_ref": "indicator--46ee7f57-6ca9-4bb4-b4e6-c85f9702c6b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337ff670-3d0b-494d-a818-c859dd75d01a", "sighting_of_ref": "indicator--322a3e63-4e23-43dc-ab48-91e6e26fbe44", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c10284b3-5eb2-4448-9ad2-920bff86529d", "sighting_of_ref": "indicator--5231cf30-df9d-4dae-bec3-c066bda6e34b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad354b6-7cc6-4a65-8e8b-8cb6aa1d2324", "sighting_of_ref": "indicator--96b8d66c-a8ac-40db-98d8-ce9b6b0a10e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cebbad30-e126-4ea6-b4be-99bb3d28f9f0", "sighting_of_ref": "indicator--d64dcba2-b10f-4ad3-a39b-3b55efc4cc8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89d9c5b-4edf-4594-996b-3995837d3b14", "sighting_of_ref": "indicator--14cb8ec3-aa8d-402b-8f18-1ae7900d1683", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--551a84f2-6939-414e-a436-b4de2f78fe47", "sighting_of_ref": "indicator--5f10b255-2f98-401b-a725-de1813da5373", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8998c626-22d3-44ea-be1a-e0f62cd7eac5", "sighting_of_ref": "indicator--09e8096b-9af1-4731-aaa8-bc4cc5fccad9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9e8060-810e-42cf-9ba7-c76ba72d1a45", "sighting_of_ref": "indicator--1681f959-40b8-432c-9475-3c6d2aee1019", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f675afac-d569-4f70-a8a2-25cf3dd41eff", "sighting_of_ref": "indicator--21b199db-7e6f-4ac0-b74f-98c081972b3d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91758038-232a-4266-9a0b-d72c3937c004", "sighting_of_ref": "indicator--0e0f0484-7889-49dc-8a03-6026ce866829", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--264e7823-786e-4d9e-b362-dbb69f4fb8da", "sighting_of_ref": "indicator--c0bdf4f7-ce31-494e-9db9-0138d62df499", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e69ae994-425e-4cd0-8fcc-e49b14b56ccc", "sighting_of_ref": "indicator--44394380-af7a-4fee-8449-26a6a5ae8bd0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f2b238e-0a6e-4a60-a153-27d2ef6cbd4f", "sighting_of_ref": "indicator--0de321eb-24a7-4da8-8c55-3ced4ecc3d46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c53cbc4-0175-4b75-b3a3-8829b53d1b16", "sighting_of_ref": "indicator--a89cd6ec-363a-4a7b-a373-5adadcae04a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1865750-4d4a-4128-9b25-fcf1507b47c5", "sighting_of_ref": "indicator--7a7620a1-22a6-4bd8-8062-90539b119ae6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31686f9c-ebba-4abb-bee4-a4ac662fae94", "sighting_of_ref": "indicator--f2714117-fef8-4014-9409-d33879c90d7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad64e24-56ac-4f69-aa75-613c7985dd35", "sighting_of_ref": "indicator--e7c3b5b6-d293-4d4b-9e20-ad9475135dfe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a67fcdea-05cd-4baa-aeff-932b28d612be", "sighting_of_ref": "indicator--9d6fc059-bac0-430d-a170-9dc43b259d03", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53981dee-5390-44e3-b12a-20608b68a0e1", "sighting_of_ref": "indicator--c598acb3-f891-45c1-8dde-456e87626e76", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86756bb8-1eb2-4b0a-9650-e07a07975f92", "sighting_of_ref": "indicator--920ab9b5-6aea-4921-a67e-d5fb835a8c71", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ad8128-37f5-4a13-8b66-02bdda139b1f", "sighting_of_ref": "indicator--598dba47-1dee-427f-88a5-5ada096a4eb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8732ec78-443c-4fac-966e-4cd1f660ab56", "sighting_of_ref": "indicator--e9e4c23a-1390-48af-8ebd-f8b46ca623b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a017725f-a8ee-4de3-9623-d6082e3d520e", "sighting_of_ref": "indicator--5dbfe632-5fbc-458e-a753-e9010ffcbb00", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c8cfea5-3db2-401e-8f21-01e762d864d3", "sighting_of_ref": "indicator--ce26e4ef-9adb-4147-b290-143a9c6c1495", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e75c7866-e00d-41e6-83a9-c3a1871a385a", "sighting_of_ref": "indicator--b9b4a25c-af70-4ae8-b5b3-b393afc74315", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad8393ab-79e6-4075-b436-a193df3e353d", "sighting_of_ref": "indicator--21d43c65-bc93-4e9a-9ac9-a38147908ebe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e7ca74-8ec1-413f-9683-dfca80e4371d", "sighting_of_ref": "indicator--71e2b9c3-edf8-4235-bb58-572cc8e8a29f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--738a0eef-8a5c-4872-a16d-feb1b9bd3695", "sighting_of_ref": "indicator--88264ef5-0c86-4f90-a07f-e6b136d62cc8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be76cde-d3e1-4831-aa9a-19dcd48856c6", "sighting_of_ref": "indicator--5d52c280-7b71-419d-8933-825c3b8a55ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5946f9ad-8cff-4c20-8057-9447147f7a3d", "sighting_of_ref": "indicator--8441a62d-998d-4e7e-888e-739d00ad2f4b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86df300a-47d7-4ccc-b79c-7b68129d0763", "sighting_of_ref": "indicator--c6beea41-9b0e-42d7-8525-eb2871888227", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51a7179a-962f-41b1-94b5-e57b793c3b88", "sighting_of_ref": "indicator--0f99fdff-5067-4c17-be65-1d1cb81a9459", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d77be166-b5fb-4824-a214-2b8639996d65", "sighting_of_ref": "indicator--597c3ea0-b372-4d55-9a47-5fa366a349df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1eb531a-4455-4948-abc0-721c66bb5dde", "sighting_of_ref": "indicator--2aec4d06-1886-4be5-bbe5-fda74030e2b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a3212b-88d9-4f96-bb38-20ee89cc3065", "sighting_of_ref": "indicator--7d22a897-4ca4-468d-9bc5-8215fd2b68b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69b30bfe-4ccf-43dd-9331-2cab0b8ba8d2", "sighting_of_ref": "indicator--399af4ab-3fb1-4692-b496-d938f87d173e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--324ecc2f-1a92-4a1a-8c34-3b23685d1697", "sighting_of_ref": "indicator--7a473118-1c9a-4ba8-9a4d-7a25ce8f9618", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b585917d-5d43-4035-a0a7-70e604d2254c", "sighting_of_ref": "indicator--5cd1d45f-c8f9-4ada-9586-6b978ff402bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1636068-21ba-4916-a1e5-6fd3e1ba5bba", "sighting_of_ref": "indicator--4cbbdd1e-a1b7-42ed-8f64-dabbcf9211bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--510c0bae-ce67-44c7-8a3c-51fffa6df7b0", "sighting_of_ref": "indicator--da2bdf7a-724a-4294-b791-a801cfe4f518", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eadb653-84bc-44eb-b24c-95f4522521c1", "sighting_of_ref": "indicator--64d1d1e7-32fd-4a5d-8ad9-9f516b681918", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ead6d9-aada-45bf-abc8-2d560b712734", "sighting_of_ref": "indicator--01a8cf29-d00b-4077-9853-dda1fa7c1b2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6bf542-804a-422c-b119-0cf35b0cc2f6", "sighting_of_ref": "indicator--beebff90-9224-40e0-b73e-92ad58e7065b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c69f8fe0-a30c-4b9c-8232-f5b416bfd0d8", "sighting_of_ref": "indicator--b2d220e6-3a58-4f17-8ce5-1bb504a7ef03", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--552a858b-aadc-4fb1-8b5e-b7c5a0bb31ff", "sighting_of_ref": "indicator--69b7ff47-1648-4e28-a086-6839cbe93515", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e29100ce-df33-4619-8dda-b4690f73bf11", "sighting_of_ref": "indicator--b1f7a277-d8da-4fa5-a431-517d9f9e8a5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b897f91-df5c-4688-ac66-d77647ac805d", "sighting_of_ref": "indicator--8117b37d-48ed-47c9-807d-212a0eae7796", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--227d66a9-6d7c-47be-ad02-3b4846b7a745", "sighting_of_ref": "indicator--2b022fd8-439f-4749-b1d7-b5144e4f4810", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b7edcb4-d45f-4530-9074-53ab63179305", "sighting_of_ref": "indicator--e5b934fc-b179-4472-a040-9f6ebb7678cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb1283c4-37a4-4d66-9afa-e582c7693edf", "sighting_of_ref": "indicator--df9d1f8e-f704-4b06-983a-d648d195957c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0596a99-618d-44e8-8313-a1165c88b165", "sighting_of_ref": "indicator--2c8b2d33-3b44-4e15-ae0a-e207016706dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4153cc57-43a1-464c-80b0-58c39cb3e9ca", "sighting_of_ref": "indicator--8a0e978a-d517-4783-8c5f-61de6f4dd09b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dca42ad-21b2-4ac1-be51-1d27e560afbc", "sighting_of_ref": "indicator--566e529c-641f-4b9b-9126-685c28dd5a05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73812dd7-4536-41d0-8ba7-918aec762613", "sighting_of_ref": "indicator--82fd9cd1-e037-4281-a443-a335417b7a87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd3ed32d-806d-4768-9269-3263b0b70bd0", "sighting_of_ref": "indicator--ff71561d-a490-4760-9739-262a61b02091", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a32a5729-f15f-421b-bd13-05bcb7c0d7af", "sighting_of_ref": "indicator--f039ba62-438e-4849-9a90-52dde053547b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc949aa2-272f-4a1d-bcd7-8b525efa328a", "sighting_of_ref": "indicator--08f7bf64-b291-4c13-a2dc-4c6f93aa1f07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecd9276c-a939-445d-b277-a138d6950cb7", "sighting_of_ref": "indicator--eefae3f8-47c7-4e49-af99-0d5001712ce1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d682de69-42c2-4176-bd6e-e78273c72759", "sighting_of_ref": "indicator--415fb1c6-118e-4af2-941d-cc51e7aec2b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f62d1daa-5395-4d8c-b8b4-3fa25dd98861", "sighting_of_ref": "indicator--014321e6-5eb6-4b30-a2b8-1f40117c4b69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd03116c-915a-413a-aca7-bb66d83c69a2", "sighting_of_ref": "indicator--8fb0b4ae-ea46-4b1e-887a-e3ef0007209a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--083e7676-9c77-4a39-9ea6-6f9e43aae93c", "sighting_of_ref": "indicator--a4cf47d8-551b-46d7-926e-561b8e38d28c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ea5914d-df91-49a9-8e5f-8d21e21b5f10", "sighting_of_ref": "indicator--7f88fc05-af2a-4664-ad56-c9818aa2b9b7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c5d2e5-566c-4a06-8708-ee24e0ac7ec6", "sighting_of_ref": "indicator--8a4b7f56-fa59-4622-a46b-e05c9a025407", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b87d9b51-6ed9-457b-bfc5-541e733cb915", "sighting_of_ref": "indicator--e08adcf7-efd9-4750-bb99-415a5eb15311", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343103f0-54b2-453a-bfa0-52d3e0897d2d", "sighting_of_ref": "indicator--f8a7f44f-3b51-498f-b13b-83feaae8067a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef77938a-fa8e-439d-b2bb-4aaf6ba592a2", "sighting_of_ref": "indicator--104114af-5a4a-433c-87b6-f3e92555c888", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c09a6bc3-2c21-4e15-a9d5-639bf6d03572", "sighting_of_ref": "indicator--18717ddc-96cf-40da-894c-b525ca30f75c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9367b3be-71df-46dc-949e-24268c9c226c", "sighting_of_ref": "indicator--fac5f52b-f129-4201-9254-b92a83d1a1bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9fe20b6-9bdd-4b52-8940-63036ff3df72", "sighting_of_ref": "indicator--620391c0-28e5-4833-ab73-0f4bbe07c1ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be055ff-bf6d-4ad8-89df-8c1ca440a673", "sighting_of_ref": "indicator--eccc1a6d-5262-46d0-bc74-6f58821a5404", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afe4552f-89c3-4d87-8be7-83d8959807ce", "sighting_of_ref": "indicator--fa4fb3ef-7842-4012-a7ce-6ecc05a8569d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14af1bba-9c18-4bf2-88f0-444482080e12", "sighting_of_ref": "indicator--34e552fd-2994-4474-bb27-83d480f8db39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc3780d7-ee09-4764-bce8-54ef521647a2", "sighting_of_ref": "indicator--b52c414c-ad2c-4b15-9ad0-a784cd2756af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad815291-a3f7-48f5-822c-51e8fd4d9b8e", "sighting_of_ref": "indicator--5d5e21a7-a132-4920-89de-760745ecb71a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35a4eca-688c-486c-821c-1b9680d702d7", "sighting_of_ref": "indicator--4b9a72bd-b69c-4cd5-ae1f-d62d5bcdfc18", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17451f0e-bb18-4a89-8f9e-297fc4a5cc72", "sighting_of_ref": "indicator--b613b28f-4dff-4c42-b310-2d30b5bd5dc5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--932fdcbe-21af-4f8a-92e4-16aa259f4808", "sighting_of_ref": "indicator--cd97862c-58ae-4bd7-b40f-e3e3728bee5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8fec20-1fd4-467f-932f-6a68f7e8d04c", "sighting_of_ref": "indicator--0026ca3e-2bb5-49a0-bb9a-689079dcdcc1", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--237eed6d-3b3f-4338-81fa-12c0704f233c", "sighting_of_ref": "indicator--6d88e2c6-d17e-4804-98b8-428fe2c41294", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fb2e9ff-e13e-491f-a249-47ebe6b4dd22", "sighting_of_ref": "indicator--3e6c4eb2-f96b-48bc-9b9e-bdd7fe6e6792", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762c2707-c0ce-4a10-bcb5-0517e4fedb9e", "sighting_of_ref": "indicator--0446e60d-3843-4f6f-a186-a1ea232083f3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ef0aef9-6986-4adc-aa0f-22af45da299b", "sighting_of_ref": "indicator--e85b23c9-fa55-4a6e-a32e-afdfe2886be3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25d194e-0b9d-4dc7-ae43-16bad37f65b6", "sighting_of_ref": "indicator--6f9febee-472d-4cac-a7ee-720619e7bc4b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d3e5d2-c6bc-40b6-a22c-b75150ff4c77", "sighting_of_ref": "indicator--0ea8f7fe-53dd-42fc-93f9-618af9abc75d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43a72ad0-9379-4646-b56e-8fdbffb72794", "sighting_of_ref": "indicator--3c8930d9-b4c6-4c86-9e8e-09bc09a77018", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f955f4b-0c1a-4939-9e88-d9507737facb", "sighting_of_ref": "indicator--ed226c78-66b9-4231-9329-1f003d8d56d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c327b76c-8789-442d-b439-414ad83cb214", "sighting_of_ref": "indicator--54fa6ba6-e829-4f32-bc94-6088d1a9776b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--086711a4-842d-4d47-a850-4fc0c259e940", "sighting_of_ref": "indicator--9aab0237-a946-4186-b2d8-9874a6244b4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0621821-afc9-4037-a862-545ad8dee484", "sighting_of_ref": "indicator--91b6b4e2-c5e3-4162-a98f-1d22ab13c716", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a474c378-f587-4704-b2de-ff6c4ee7a493", "sighting_of_ref": "indicator--6becaf7c-f8d4-4680-8060-04baa55b4389", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e50c1b2-67d4-4e24-9cb6-dcb0d07db21b", "sighting_of_ref": "indicator--44801442-d7bb-4512-a4c1-41a3f3d69ab8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--757aaf12-5f77-48ac-a014-5239331cc884", "sighting_of_ref": "indicator--b8babadf-546e-45a6-b561-74d8c7dc60b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e4e3ea6-d824-4521-9d55-edbd47f92acd", "sighting_of_ref": "indicator--7af63e22-5b65-4e1d-a068-499a66ffa405", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebf22c6d-64ef-4848-b6ac-0247d1f62d29", "sighting_of_ref": "indicator--10f88f7d-354f-4500-95a6-62df6df06560", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a08432a2-7b14-4804-adda-7299f9bf97b9", "sighting_of_ref": "indicator--cc212020-f5d2-4c42-84ff-c902c7de54c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f316c71b-4a96-4b86-8826-37280c924f7a", "sighting_of_ref": "indicator--86b8b693-e460-4476-bc25-f8ca702ee700", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dbc75d3-99f6-4341-9534-fddafdb0a1b3", "sighting_of_ref": "indicator--bd672f16-6ef2-4ccd-acf4-af82823f309b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28d67055-ff1b-4054-8a65-762c9a236f52", "sighting_of_ref": "indicator--b50ad6f6-d335-482e-a37b-0da55dad2603", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f1b3fc5-33cd-4d08-88f4-cf522f7b93ea", "sighting_of_ref": "indicator--f759713e-802b-4026-a416-15070db19abf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3008f8b3-3fdf-4f1d-b79f-3aaa96efbb72", "sighting_of_ref": "indicator--6b2cb838-8655-4ea2-adfa-2a8753dd90dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cfc8be7-d60e-4cdf-8c40-a49c528691b7", "sighting_of_ref": "indicator--a360280b-321c-414c-bd54-c18bf2117072", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f64dba90-1fb1-4681-a831-45d6c67aa09c", "sighting_of_ref": "indicator--17153878-b425-4f1a-87dc-46ab84162029", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--220990fb-9828-44e5-98d8-376d41f22723", "sighting_of_ref": "indicator--da909be6-db24-4325-9f0a-11c21dd3d88e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f852c2cb-031b-4889-ae5c-415ed9cc5044", "sighting_of_ref": "indicator--4eb3ff49-724a-4f02-b484-00200af400a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--130142d3-c814-4073-84fe-1319d0474205", "sighting_of_ref": "indicator--bc050132-ae30-4800-978e-d751bdc2ad51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa02c1a5-286a-4f7f-9459-38e4927c36e4", "sighting_of_ref": "indicator--a3209a48-91bf-4b2f-8c74-9a60ce95eb93", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c0d740a-4c5f-403a-9d8f-f3010d8abd8a", "sighting_of_ref": "indicator--dec8d7ae-73fb-4196-9842-a58473bc8b25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6f7711-cf59-440f-87f6-3add04b53ac1", "sighting_of_ref": "indicator--a67f1db7-c8f0-44e4-979e-037eb5ec9cbc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b9def63-b59b-4141-b4ab-f600eba48ec1", "sighting_of_ref": "indicator--228eb816-5679-45ed-b5a7-bfd388e79fc9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71f4076e-6621-49ef-9046-7f9e83f179f2", "sighting_of_ref": "indicator--a6041836-2a6e-4964-9705-710805d3f85b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4109a17e-a866-414e-bce0-68e8a5fa8c7d", "sighting_of_ref": "indicator--fa44a188-5d67-4e92-92b4-758fc202c417", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5cdaf2-fbb2-430e-9a9d-959c7852f3db", "sighting_of_ref": "indicator--d5103bfb-3054-489c-8802-58f164b5e0ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2cfb9b6-081d-4a1f-98d7-43b35805a861", "sighting_of_ref": "indicator--fbe2f436-f778-4675-843b-8df7204fac67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d33d075-25a9-4ce6-91ae-e7d161968042", "sighting_of_ref": "indicator--5f869d6d-5942-4d1b-b536-4640793c3e72", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a1ea98-a91a-44b1-aa9b-6896a6296fde", "sighting_of_ref": "indicator--f8d505e0-7452-4c0e-8daf-0cd41192e2cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b20b3a-7304-4d77-a76c-d80e397e86af", "sighting_of_ref": "indicator--a143e826-6d25-4412-a23b-f156576127ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6beb167-0085-4791-9461-8104a680af26", "sighting_of_ref": "indicator--c017a379-2448-435c-bfde-9aa34f80acaa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7d71634-12ce-4024-a893-ed98ef002c2c", "sighting_of_ref": "indicator--1c8c1788-b74b-4def-a807-fd9625476e09", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f17b41d-2a5d-428d-8feb-21969584044c", "sighting_of_ref": "indicator--2f434748-c100-409f-a70e-21a73e61507f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86c59d8e-a849-4c4f-b5c8-d9675d141f60", "sighting_of_ref": "indicator--526d0dde-4396-4fc6-b146-8d16c9086295", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad09cdc9-4fdf-447c-96bf-1b464abecb80", "sighting_of_ref": "indicator--ceed4979-934b-45fc-ba9e-ab765ee85157", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ca35fe4-da0c-4950-91d4-c460bbab762d", "sighting_of_ref": "indicator--73241776-665e-47c2-82e1-7f650efb517e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539ce474-102e-40fa-949b-9e4cd8d1a831", "sighting_of_ref": "indicator--a1fe0016-b41c-4259-94aa-44803fe16dce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d70903c-434a-44c2-8442-6b093d754024", "sighting_of_ref": "indicator--5e71ea6d-140f-4bce-9c32-f33054263df9", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--276615bc-a1be-4252-933e-b621628b6a85", "sighting_of_ref": "indicator--64fe8f3b-9d69-4d4a-9791-efa55e07e3e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--989eb749-18e2-4920-8c07-46dabc788802", "sighting_of_ref": "indicator--4ba66eba-c42c-4cc3-b557-f690121bb6e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a4d3bdf-266b-4c69-b6cb-33a74eaf8539", "sighting_of_ref": "indicator--a7d0ab88-83cf-45b9-b3fe-f9da3b353261", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--441b5bd8-592a-4b06-a33a-25567efd0ebb", "sighting_of_ref": "indicator--9cefb332-6edc-458a-965c-cbb10612d376", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dde23f67-5d5d-4f4c-a45f-a0a970d51631", "sighting_of_ref": "indicator--daad3b67-832a-4831-aeec-8ac34956627b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0142c5a5-dbd0-4ec8-b208-2c454a10ec3a", "sighting_of_ref": "indicator--5cfd2909-0f1a-4808-8e39-cfb9a1f0217d", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d7f6a16-c490-479c-90e1-acdfff1d7ee0", "sighting_of_ref": "indicator--d4ece8e4-c882-45ba-807a-cb64bf8884ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2655215-90c8-4c45-a2c4-7571c3ec05b9", "sighting_of_ref": "indicator--2cc3d64a-5585-4f6e-bf17-e07cbd9fd94e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--787de98f-ee83-462f-8aa8-79f6c64bc37e", "sighting_of_ref": "indicator--f8ae8752-9606-49d6-9d01-ce12c46c87ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42bca92f-62aa-4d28-89e4-043780b1f182", "sighting_of_ref": "indicator--f75ff5ae-a19c-4009-a5c1-9c6fc91fe033", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a6dd20-ca4f-4abc-a2ee-b7f6d7f7f5dc", "sighting_of_ref": "indicator--125c68de-e363-4760-800f-4d3a5d1cbb94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17449ce0-bb44-4c9f-bf27-20a72ad06026", "sighting_of_ref": "indicator--125c68de-e363-4760-800f-4d3a5d1cbb94", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7de0af8-878c-424e-8e65-f2a0c0d54f73", "sighting_of_ref": "indicator--1fa973ae-7e79-407d-b0af-29bc4652b944", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e6f233-ca17-4b6d-b774-e6a95cd7625a", "sighting_of_ref": "indicator--8dfb798b-1297-4663-8d86-ecc53f361adb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f681b15e-2b7c-4dbf-9324-8c8052b33141", "sighting_of_ref": "indicator--a1d5bbc4-b721-4f5f-b8ac-4b4fcc59f1f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9378a8fa-0c00-4510-afba-ce0eb773b514", "sighting_of_ref": "indicator--305e1519-8de2-4cfd-9a10-8f9d08433c07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce7de614-d573-496b-b705-2c7780741045", "sighting_of_ref": "indicator--ec02cbfb-fa5b-4df8-9b3e-b98e34e85600", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--370ed9ca-67fe-43d9-817c-03c5ca0d7045", "sighting_of_ref": "indicator--32626f32-6d16-4423-9857-61945484db7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ee5c7c-761b-4766-bc8b-f5c7cf9676ae", "sighting_of_ref": "indicator--62e70b23-8dea-4fc7-937e-9d2fe94faa54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c62d2a9f-7e23-4f45-930d-c9d1e98cdb84", "sighting_of_ref": "indicator--d2c172f7-7cda-45a0-b6fa-1e787407456d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2df3fc88-b667-43e4-be44-13f7aff70a7a", "sighting_of_ref": "indicator--9031a266-bb44-4b9c-a738-74232efbe605", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0b74ea5-fca6-4042-9d80-8693913b9388", "sighting_of_ref": "indicator--23cea518-480b-4794-936b-ad5267e834ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--385b3677-d356-4fe0-9b05-9f56de2572b4", "sighting_of_ref": "indicator--c81a77bd-9fd6-4622-8a4d-ca39b9be25ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c1e88a-3d8e-4d7f-a63a-642d8b5712f7", "sighting_of_ref": "indicator--59e19330-76c5-4182-a322-edde73ba7da1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58874f37-16d9-410f-8627-3f92bbe71285", "sighting_of_ref": "indicator--740977db-ed33-45a8-8dd9-5b5ef6c2eca5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ddf8a8c-517b-43fc-9108-6fd9f4067386", "sighting_of_ref": "indicator--3a81df84-427a-40c6-b5b3-03ff0d339d7f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be25873-a2cd-4083-b6ea-91fb76cc0b5b", "sighting_of_ref": "indicator--0317e4e1-6891-4481-934b-233a8faf4e0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc364317-c318-4fe9-b9cf-b39d5eb9b05f", "sighting_of_ref": "indicator--d95b7767-e67c-477e-9efd-b3c08b2be8c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95d64c49-13d6-40be-b7bc-cb347697f7c9", "sighting_of_ref": "indicator--642795d8-5b83-4b6f-a21d-5a11aef5604e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7239987-5eba-43fa-a61a-d27de49dc792", "sighting_of_ref": "indicator--2f90bae0-b489-4d49-9522-4cd5501b9e82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c01497-04e3-4f49-8bd7-dddeb7b90aef", "sighting_of_ref": "indicator--2db09ca7-d93e-4787-ae2b-4b4f0782771a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e53234-b39d-4c06-ac85-c3e6310906f0", "sighting_of_ref": "indicator--7edb358f-137e-4fc4-ad27-c066e1f4da7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--466b08d5-c696-4531-bb4a-0928fdf80ee7", "sighting_of_ref": "indicator--6cf13fe5-5edf-4d4e-8f19-1e89fdfed3fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba08977d-0dd5-4cb9-9d2c-a03da7fb7ffe", "sighting_of_ref": "indicator--1ac48e07-575d-4c23-9e7b-36236881f456", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8447de1f-7979-4a1e-8e15-f77fe4bd70dc", "sighting_of_ref": "indicator--99982b21-6e95-4f8d-b24b-e75f3dd9ab06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71944e6b-5cf3-4ab5-99f7-c59930fe26db", "sighting_of_ref": "indicator--cc537510-59e2-403a-adef-44f5f2f9b9f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29e72611-3d4a-4c5a-9f3a-d9b1deeaabfc", "sighting_of_ref": "indicator--cc167214-d5d7-46ed-80f4-bf058b356acd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f5a969c-3382-4cb4-8185-01123112e1b1", "sighting_of_ref": "indicator--9cb67877-2f07-4db5-8513-fbe3590d0dab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f40c2f2-95d5-42fd-8c3f-32977cabb372", "sighting_of_ref": "indicator--8ed89c1b-e572-49bb-867c-bc7703e81187", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a67ef6-d7d8-4cc5-88ab-e1036f965b16", "sighting_of_ref": "indicator--355d8b20-9816-4f77-b248-85d675b9aadc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d98777a8-5f7d-48fd-9349-54363e3387b9", "sighting_of_ref": "indicator--3800ac4f-7add-4795-a7d2-2c0cd4327c0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09cd4a81-b251-4e1b-a840-12f4d51d497c", "sighting_of_ref": "indicator--de348575-ca8e-4d0a-921b-9361318f14bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b503b92-e050-4338-8513-969b52400fa6", "sighting_of_ref": "indicator--236f53f4-f40d-4553-8efb-35a73cf9571d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10be5ff-844c-41e6-a554-0177cf6c83ba", "sighting_of_ref": "indicator--87ee9ca2-288f-4aa5-b198-29ee2ada1982", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fa6bd78-54ab-4628-bb5e-93f21c360c8d", "sighting_of_ref": "indicator--7f42b075-8bec-4ca4-ae94-52a3855eedab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0124db7-7801-4aeb-927e-936b8ccc3db6", "sighting_of_ref": "indicator--70771d01-941b-454c-a0de-f3adb05178f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97601773-099c-41bf-86c9-1a0bdff6645d", "sighting_of_ref": "indicator--01409f07-5484-4da3-94d8-c3039a20f51b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--930ade33-2535-416d-b55f-97697ebee1d1", "sighting_of_ref": "indicator--e17929d1-2728-42d9-a31e-439b57a4bd53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01bf79ba-a89d-4694-bef7-303baaaac9af", "sighting_of_ref": "indicator--b12cb761-037d-4a53-9c95-c0f93d5ea883", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20f5038-b5bf-4d24-af17-9be16dadb584", "sighting_of_ref": "indicator--44fdf3df-d8f4-4cca-acef-1978ab40875c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7149da76-6c9b-4392-84fd-2ed80f2b19f3", "sighting_of_ref": "indicator--09930705-f539-451a-969b-30ba2f47d243", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf8f414-81e6-4dce-834e-3c589e0d42a8", "sighting_of_ref": "indicator--09930705-f539-451a-969b-30ba2f47d243", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad09266d-5788-4c2a-8b39-02bd4bee180f", "sighting_of_ref": "indicator--31af87ef-bdc6-44c9-8b3d-f5ba2e648b5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad11e87-c94b-41d4-893e-c335fefb85d8", "sighting_of_ref": "indicator--4370de50-d80c-4641-a882-697854510427", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194e5cce-5169-4ac1-8fcc-12c00bc89a39", "sighting_of_ref": "indicator--f3dfb95b-1ad4-42d1-874c-4cc1ffc4a2d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--094e0ff9-9f44-4372-a9fa-1f010592c8ab", "sighting_of_ref": "indicator--d6231521-f3cc-4f78-9caf-73ae665cf3f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3eee4d-0d3b-4b54-ac79-4c69838e38a4", "sighting_of_ref": "indicator--5575e46c-88d5-4f7d-945f-308f46c129d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd757ec9-1b15-424b-9445-318fbc8d0467", "sighting_of_ref": "indicator--5517973a-1ddf-4d8f-9c73-889190e195a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--565c11d3-7d92-4d04-9102-dd9aea96a2ad", "sighting_of_ref": "indicator--17423507-2be6-40a0-a3ea-60c2b53b8b56", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b083f035-f742-48ab-b8dc-8aa6c2c0f2c5", "sighting_of_ref": "indicator--44c94201-a87f-40bd-bf41-762c8026b110", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba6e7952-6d81-4ee4-9fea-491ec610d2d8", "sighting_of_ref": "indicator--9b595d11-8c39-431d-be0f-8c73f00d0a18", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5776fa9c-8d26-4a00-84ec-8fe9f9312855", "sighting_of_ref": "indicator--ff4400dd-863b-4db4-bda8-6ec6abc43444", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3ac221-3870-41a5-bb5d-3a320d174f8a", "sighting_of_ref": "indicator--58b56eae-0478-430c-b2cd-157075d31dad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1ab8d3b-dcb3-46f5-8a71-550dd7b2034f", "sighting_of_ref": "indicator--6ce58040-7ff7-4791-ba12-af3e3f1bfa1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de0f859-09ae-41df-98dd-70d7275b18dd", "sighting_of_ref": "indicator--27ef471e-3c6a-43a3-b3b2-4d492e8983a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dec6f87b-4906-456e-b9e1-de84f2cbd036", "sighting_of_ref": "indicator--c815d2fe-105e-4fd1-a749-888ad417dc38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca1260c-1652-40e5-b82a-97974028a779", "sighting_of_ref": "indicator--033d43d3-939c-40b5-a916-843e2aeebbe7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ebb5be-ebad-4d43-a3d8-9fd285e70516", "sighting_of_ref": "indicator--cf547142-5c18-444f-9342-efade91a452f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54ec9e01-4d39-49d4-a7fa-2acf0eae6d74", "sighting_of_ref": "indicator--e6b61cff-8155-4b07-a269-424b804abc56", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ef847a-1c00-42a2-bd48-4f1c45f70256", "sighting_of_ref": "indicator--22ef3466-1fc7-4437-9ca5-bcaac3859ce4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1949fab7-236d-4a4d-915e-a296ab24073c", "sighting_of_ref": "indicator--72026e33-e953-4a6f-b931-29fe6412680f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a264a31-640b-4a30-b9b0-5fcf6b8e62db", "sighting_of_ref": "indicator--bda0acd0-2bcf-4a6f-a4c1-4791bd4dab79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8f4c00f-f71f-45c1-b85a-c664adbffb84", "sighting_of_ref": "indicator--501f715b-c541-4dcf-9fe6-ea1a9ca081fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--648c7e4b-bcf5-4246-bba5-914b13cc1e5f", "sighting_of_ref": "indicator--b71a32c0-decc-4e35-b231-448287f491f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f8a792-2c1e-40d6-a57e-c9f4dcc9ee70", "sighting_of_ref": "indicator--bb6ba52d-9646-4579-9287-c4410f90e229", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480c22d6-7928-4038-9d75-236315ac241c", "sighting_of_ref": "indicator--e59a0f17-ea8d-45d1-9e89-8872c27a38a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ca2ed0-1705-47b6-b648-89727cafdaee", "sighting_of_ref": "indicator--8071c1d2-4d88-4b68-a865-2c2958382b05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--431a162b-aaf3-46e7-b9af-eda1ded3c5c6", "sighting_of_ref": "indicator--19676a98-394d-411a-9ef7-ebca74064f88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7fa3609-9ec1-4597-ac91-57a10b2df658", "sighting_of_ref": "indicator--f34d742b-64b3-42d0-af73-6b9dd83c1a2d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdfd460f-539e-4278-9fbe-ee8fcf61396c", "sighting_of_ref": "indicator--1399bc76-373f-45fe-91f4-625b91bf8c75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bb9ce43-240c-4910-83e7-fd5fd57b1b54", "sighting_of_ref": "indicator--18dbdc62-75ee-4e7f-b20a-3953f3edba6a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33cb81a-6d5d-4687-8b32-8558b5d5d99a", "sighting_of_ref": "indicator--88c53fff-dbf4-4274-a34f-d55bd46315e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95b84c7d-a769-40b5-881e-0c648e978f4a", "sighting_of_ref": "indicator--03d38fd3-6251-4f8e-b782-962538047d67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643c439f-dc75-4b1f-849e-71e04f486cf9", "sighting_of_ref": "indicator--8facf219-c96f-46da-bc49-d284abf696aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d22c733-01fd-45ce-bb55-cb55d5559b61", "sighting_of_ref": "indicator--fa3bd905-9d16-461a-8d01-5ad003f8ecf7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d375adc-c5ff-4d4c-b0a4-306ec352df05", "sighting_of_ref": "indicator--92fd9932-7ea4-44e7-97e0-01ed7edd6934", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2868749-8917-4e05-af8d-af9dd2ebaeee", "sighting_of_ref": "indicator--0dfb0da9-fdda-42e1-8ee4-1acb2481e865", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa3e89aa-f39b-4b7c-b748-38afe9d641ef", "sighting_of_ref": "indicator--dad94d16-17c7-45ed-ba97-907480f7a5ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528e3d34-402a-40da-8800-59708a4701cc", "sighting_of_ref": "indicator--c0ce22b8-34b5-4f42-9d63-4915c0d666ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f85a1ab8-a9ae-4fe9-9112-1114dcfd5206", "sighting_of_ref": "indicator--969e0821-1e07-40bf-9381-ae220d496d1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d2bdf60-94f0-40b8-92d7-b56096b9667d", "sighting_of_ref": "indicator--474901e0-6c72-4785-b0c8-c55cc8427941", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec376e2f-9ca0-4bfc-a30e-7bf7341b649f", "sighting_of_ref": "indicator--730e82cf-c216-490d-8603-7ab7db056bac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--048d7ea2-75e6-42ca-92b4-9a8b62e86b16", "sighting_of_ref": "indicator--36a673c4-683f-4f27-8703-862a3d2723f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0cedb9-059e-47c4-a0cf-ddb0f436927e", "sighting_of_ref": "indicator--e3b65992-47df-479f-bbe5-3cebc543edbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc89e46-d8d2-4aba-bbe9-9cdc5f061da7", "sighting_of_ref": "indicator--092c87d7-1c31-4a09-8872-e9d3d16c00e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--382eb98e-74a8-447a-870f-74d83dc30dbc", "sighting_of_ref": "indicator--6582e8db-ba11-4018-9547-8c6098071388", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--101c3b01-079a-41fd-a27f-56c50cd9f6fa", "sighting_of_ref": "indicator--e02cf31c-523a-4721-ac4a-7b4288d953dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7aeb85-4ea8-47b1-9fc6-dddef5e4a29c", "sighting_of_ref": "indicator--8c1be848-5383-48ae-94c0-a2436bc10fdb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8ce0ef8-d3ca-41e9-af47-60e8569cc292", "sighting_of_ref": "indicator--cff16dee-8311-4f4a-8672-4f28284fcd81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9141e7-0725-411e-a373-8b370e3fdfc9", "sighting_of_ref": "indicator--8535860a-cec5-45af-81e5-fbe721b36a03", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b614e2e-740e-4bbd-8f85-f12e50818fde", "sighting_of_ref": "indicator--57bc7a3c-be19-4c4f-85dc-ab1b095b06a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90c94de-4f14-47f2-9dfd-316a884a7d83", "sighting_of_ref": "indicator--4411ea39-31d7-441b-9258-70d3e23563fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01b60c44-3b90-4f6e-9b09-8f6ceb7a0caa", "sighting_of_ref": "indicator--47bde26f-46d2-44ad-bb63-53906592812c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd41f37-383e-410f-8c83-6934b5e68a84", "sighting_of_ref": "indicator--e93cfecc-7179-460c-be8a-f56eedfc2946", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06ae0e55-6bd6-405e-9156-3b6a11b72a35", "sighting_of_ref": "indicator--7940a199-b2a1-4ebd-a89d-a139bf919c46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--688b8a32-356b-466f-a9a7-d6b01d7bad9f", "sighting_of_ref": "indicator--d8b366e1-b771-49d9-b57c-9a7e16ac8d07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e680accc-9cb5-4305-b008-bed381c3b7c6", "sighting_of_ref": "indicator--ac7c4baa-f7a0-46fe-afda-32d2e31d900e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4d514ec-35c5-43a5-b36f-1c0bf911bac9", "sighting_of_ref": "indicator--afe79835-c4c2-499c-8eee-a16f540a0410", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278318f5-d0c8-4df4-ad34-d3c3f4b31426", "sighting_of_ref": "indicator--4bc4b3af-f031-4eba-9d72-bfb7b363d34d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689ede94-11a3-4e7e-88a1-d7eee4d7c6f5", "sighting_of_ref": "indicator--263b49ab-46b2-4b49-9b54-daff523704f5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb61d940-d043-42af-8e2d-118613f7545a", "sighting_of_ref": "indicator--e1937631-225d-4e03-beac-0dc47f584f1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c020e581-fb41-4306-a54e-130bc10f7cd3", "sighting_of_ref": "indicator--c32da738-3106-445a-8728-6c51485325cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--764f3671-9e2f-4175-866c-b00876c0c2f3", "sighting_of_ref": "indicator--638031a2-ceb3-417a-9bd2-bd626c132164", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27425995-f675-4cd9-806a-b11831687e32", "sighting_of_ref": "indicator--4136646b-db6a-4bbc-a413-12f7b4574b9f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7facef33-4b6c-4abb-bc75-1263ea6e1a4f", "sighting_of_ref": "indicator--837edd15-83e1-4485-910a-b9046ba00a1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad6ea086-1e7b-4e92-b316-ae448fec4957", "sighting_of_ref": "indicator--3c99a59c-7b4a-4464-a266-3abce48cb6e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c219e58a-fb8a-48e8-aea1-b7f61aae1f63", "sighting_of_ref": "indicator--be3216dd-8957-4077-93f6-2b65d556fe68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c50510fe-3f99-4925-a474-fa66f9413413", "sighting_of_ref": "indicator--b56b8e30-0598-4e11-829b-7763df747f53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5813ee8-2194-4ecd-ac90-2e557e3ac339", "sighting_of_ref": "indicator--a5f9b848-c11d-430a-b2a2-7f3a0a961098", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ec4c71-1958-4bfe-ab93-188739b6ba76", "sighting_of_ref": "indicator--78fcc6de-f4df-4715-9116-b63e628070dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43167bee-dee1-4ef8-911e-7f14c93a611c", "sighting_of_ref": "indicator--85b04adb-002f-4289-a354-d7febab7a04a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63d7446-80fc-43b7-a91b-f750708cdad5", "sighting_of_ref": "indicator--fc291da0-474b-4d2d-aa0e-1f69261d488a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2710c172-e0db-4e40-ac21-38ec9cd01df3", "sighting_of_ref": "indicator--e29bbc7f-669e-4233-a447-60bf7e2992ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a40aca2-5b32-4136-ac27-f7acdf04c815", "sighting_of_ref": "indicator--456ef3c8-2f86-40d7-bdf3-ceb052c2a93b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345df82c-df65-4ad7-9b1f-cdaf42646b86", "sighting_of_ref": "indicator--52107653-fa53-4085-a46a-f729e357cc51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b3d8e47-dda4-4454-82bb-a2918aa5774d", "sighting_of_ref": "indicator--3a9f347c-60af-4d5f-855c-c7f95b23a66a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55fffdce-cbb9-4153-b800-926076b4bfcc", "sighting_of_ref": "indicator--87a404c4-5577-4152-8e10-e6ced81c0e69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e445597a-5e92-412e-b3cd-c3b941ee8a7f", "sighting_of_ref": "indicator--b8eab87d-25bc-43e8-af25-8208082c7d0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd823121-9bd6-4cc8-85ab-971a718fe558", "sighting_of_ref": "indicator--5a6f0d3e-484b-4276-a4d6-3c51ac254802", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22cd89ba-9c70-4ccc-a33e-c8dedc561e8b", "sighting_of_ref": "indicator--326978d0-dcd2-43ac-aa0c-37a55d225821", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8592a7-258e-49a0-bb1b-4e13c3e4672d", "sighting_of_ref": "indicator--ad09d1d1-ae8d-43a7-b260-45f868ffbe97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9829dec-23b4-4079-a7f5-84339bb63653", "sighting_of_ref": "indicator--dff98657-2f0c-4ae3-aa55-4067a1bfbf15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e99ef238-e551-4505-b484-4de060f612fd", "sighting_of_ref": "indicator--c1f4df21-8691-4e95-b184-01443d83ef71", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53ec1565-263b-471b-bfeb-752108096ab1", "sighting_of_ref": "indicator--045fdbb7-1cb6-45fe-8c91-645618fbea57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca01b9d-4344-462b-938b-a27739612961", "sighting_of_ref": "indicator--85282088-e0c7-445b-a28e-04ac79371e67", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4a77c8d-30d4-42a1-a8b9-089c617c05bd", "sighting_of_ref": "indicator--a2c1e877-31c5-4b60-9c3a-a4d5048b055a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b9a05c-1909-442a-ac30-c8380e4c6712", "sighting_of_ref": "indicator--d22ff2be-59dd-468b-b451-efc06defb8e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c10d4a8-4b25-414a-8331-bb7f854e2bc6", "sighting_of_ref": "indicator--98933ba6-cc26-49eb-a940-43657ad4fb9e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e968e05-6483-49cf-b8f4-6b0c835c50aa", "sighting_of_ref": "indicator--477d577f-213c-4cb3-bd93-8808e3b3ccc9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e656912-3006-4a32-a083-75c0e79118ca", "sighting_of_ref": "indicator--b8871424-9a67-4472-9cd6-384f53202a92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdab441a-a47b-412b-b03d-8ae489668485", "sighting_of_ref": "indicator--8941a483-cf56-4a0d-ac89-44c61c24883f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a0ef91-3091-4163-ae4f-abb01400f4d5", "sighting_of_ref": "indicator--7f154da8-e1a2-4f29-bbda-39d165fdb250", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98854e36-0f17-401a-8456-f05869461ab9", "sighting_of_ref": "indicator--3799fef2-b0a1-43a0-85ec-b8a74c32edb4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8908a3f9-87a1-4b5b-9a34-6c7e4072a93b", "sighting_of_ref": "indicator--45ec34a3-3a5b-4271-9a94-8448f4052cbd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9a26216-d7fa-4a22-825a-9431555dca2a", "sighting_of_ref": "indicator--ed58ed9c-c78c-4a47-86cd-fa3271168801", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9057e033-6693-4bf1-bd59-fb2062defbe2", "sighting_of_ref": "indicator--2306c2bf-4b13-467e-81d8-ec8a3a262d0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--397844ea-1086-4256-a6be-9d020fe42ece", "sighting_of_ref": "indicator--b7f47a28-ad8c-4628-9950-b21e6bd6f400", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fb7b14e-a9c4-44de-ad8e-b6770e957d76", "sighting_of_ref": "indicator--e03f3f1e-94bd-4112-83d0-99c80f5db7ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad19e49-4c19-4b25-9ecc-62008038726d", "sighting_of_ref": "indicator--c2079ef0-fd22-476f-9e03-676ffd33c2c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bce5573-c07c-4b92-8e74-8779a295510c", "sighting_of_ref": "indicator--4f91b278-2319-47c3-a8fd-489ef886ad12", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5831f82-4699-4b89-ba79-9599513b091f", "sighting_of_ref": "indicator--5656ce49-e94b-42f8-8f85-c3770771f3e8", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--808c641b-2119-4e9e-aa6b-711c5bb525fb", "sighting_of_ref": "indicator--64ec2913-faca-4cb9-9c41-8bcc63aacd39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fcd24b5-2de7-4fe6-b923-cd704bbeb180", "sighting_of_ref": "indicator--b9b5dbb5-756d-4443-b04f-d47b75254113", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b87118d-7ec6-4cf2-b885-692083052344", "sighting_of_ref": "indicator--777449d1-7653-43d2-96d7-5ec408c1c3a9", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d605c7cc-2677-4f29-ba4e-0dcc30c95f90", "sighting_of_ref": "indicator--8d48ebb6-277e-4241-a9d8-c4ac49cce367", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18d4d12-9213-4db3-bd29-5474f48cceb4", "sighting_of_ref": "indicator--a9998e72-fb84-4a9d-a05c-b484ecabf78e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--265ab6b1-8f61-4ce5-8821-104fb168fda5", "sighting_of_ref": "indicator--adfa46d9-a257-4157-969a-6cccf03890cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd501d75-f772-41e0-a802-ca024fc975a2", "sighting_of_ref": "indicator--07b9fc64-43e7-4569-a963-88b5784f259b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--236a5b05-0102-4d41-a8f2-b2d98774071e", "sighting_of_ref": "indicator--007c2e0f-34f9-450e-b830-0a0ad4b23c2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77d53d78-0eb7-462a-a280-c9570cb345b9", "sighting_of_ref": "indicator--c4821db6-5d48-4efd-8b96-02b699654928", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b30182c7-1da3-4273-8fdc-81bc7f3a36a9", "sighting_of_ref": "indicator--287db9dc-38c4-42e6-b990-79ee8e692019", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e82c124-2324-4bf0-86c9-96d6d19579d5", "sighting_of_ref": "indicator--002e8f0f-021e-4937-aef9-e112fc0ab10a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c821774-c24a-493c-8051-d215f16d2c86", "sighting_of_ref": "indicator--8eaa7c65-24ac-4958-b714-e78aa70943cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef8e7d01-df1f-416f-9a1d-781aea4688bd", "sighting_of_ref": "indicator--1a6d30bb-ec1c-4f22-a208-2ae64bb2ae58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e21f522-d861-4318-9db3-458f5f21db68", "sighting_of_ref": "indicator--96c89066-32e9-45a1-873b-594877c32ce8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7496716-1d3e-4747-84a2-4c404b89a553", "sighting_of_ref": "indicator--cb41a2f1-b35a-441f-94c2-4b8d8e61bf2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a391c970-2c3d-4b69-98f5-2b97f61f131c", "sighting_of_ref": "indicator--7b84b43c-e585-4522-bde7-bd377f354c9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1556ee-4482-442b-a871-25deee1bf871", "sighting_of_ref": "indicator--df1b57a9-924e-44e9-b183-66b9f19b933c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dcf2391-7efe-4af4-92c4-60cbd39c33a6", "sighting_of_ref": "indicator--478f3b26-4009-44cc-9324-7a8026ccbc31", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea61df26-b293-4240-8e4b-28820a713e06", "sighting_of_ref": "indicator--0da48a86-8424-482a-961a-172d5c6588fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce881b01-46a3-4c28-a4f0-5ee5af99c8bf", "sighting_of_ref": "indicator--e98e187e-9fd0-4845-8806-2ced5647e82c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eda37f9f-7201-4e6c-a096-1c4017dbb63e", "sighting_of_ref": "indicator--22127bfe-e3f6-41e2-a5ca-ede13d461b3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9669bc74-c732-4c19-9f41-ae5b472c2ea9", "sighting_of_ref": "indicator--c1100413-f6ec-4853-ad79-180ecb47cc60", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6984cf1-92de-4d00-9c03-4b0a023a75ec", "sighting_of_ref": "indicator--83ad8de4-8f9e-40ce-9f56-37cf0c1c669c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bccd36cf-496e-4677-9229-72ae46063d47", "sighting_of_ref": "indicator--617628ad-2217-4f3b-a3a2-dd21db54f360", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7f3b49f-b93f-4476-98c8-b5889ce8aec1", "sighting_of_ref": "indicator--1171b64a-b9dc-449e-940e-3bc774aafc67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--438316fd-05fa-40f4-995c-2bb876c0da75", "sighting_of_ref": "indicator--4aeefce0-5248-457c-8981-10fb0938d5c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--849c9b06-ee5b-4946-bf1a-95e71e7aa9fe", "sighting_of_ref": "indicator--17298410-5e8a-4c52-a7ae-ba900fcd537d", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b32da3e8-6f05-48d3-8ee1-7bccc90d8c7c", "sighting_of_ref": "indicator--4cc9a68c-d8bc-4cc1-a7a1-38b30feb4447", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae512fd6-4b3d-4234-8c1f-cf3a772f7419", "sighting_of_ref": "indicator--468da4e7-e164-4799-a9bb-bfea3e398198", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44be5e0b-137e-43b0-bc19-aab33561aa9a", "sighting_of_ref": "indicator--fdfc198d-ce4e-4f6f-a0bc-933d73322d58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36cff8d1-16da-4b16-b6e0-6e0e37ed15fc", "sighting_of_ref": "indicator--18ec60e3-4c84-46d4-af7e-3d05c9acaed3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d3fe35-c4d6-46fb-b955-c4716b1f33f2", "sighting_of_ref": "indicator--a21731d1-0ca4-48fd-96e2-b0dd6c2f749b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c2cdda-42a0-4849-bc97-50ef460bafa6", "sighting_of_ref": "indicator--54d9f4ca-b675-44a8-9b2b-6590f0649dca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c49cd4d-e1c0-4704-b0be-547ef9491b2d", "sighting_of_ref": "indicator--2e4534be-f378-46c1-adce-ae10518932c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0a24b3e-97bd-4864-a568-b40de7c248c0", "sighting_of_ref": "indicator--44df76bd-27d8-4196-b46b-c9ffed97062a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b773d626-2381-4c1b-93ba-3a7f65f93acc", "sighting_of_ref": "indicator--3e4e913e-d525-4906-9c24-adb8f0c304e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff78239-0030-41a3-91c3-27085fe89f15", "sighting_of_ref": "indicator--52249d9d-09d6-4491-8b2e-bb80a8905e9f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac67e44-7359-4cdd-af22-9cb3e3be4f0b", "sighting_of_ref": "indicator--18be7704-a82c-4b07-8c21-1bd47bc435fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f5fe51-f2b0-4bdf-9049-e0824d899f81", "sighting_of_ref": "indicator--55a6e4c4-6b2c-4e44-b158-663773307c1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c813bbe-a8cb-41f5-a8bd-fb0c51b5c5a8", "sighting_of_ref": "indicator--61c4421e-1311-4c42-94d3-b32425d3e058", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90b2589-ecb2-4197-9e2b-cc6f6e98e00b", "sighting_of_ref": "indicator--a11785b6-3efd-49bc-88e5-cacf3b07f3fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f9ce22-958d-4b93-b5a4-2ac1b9fb0a2c", "sighting_of_ref": "indicator--c141ba86-f820-49c9-8636-3c4c914d0da6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ceb82b10-a2a8-43d9-9ca0-adb1349554a8", "sighting_of_ref": "indicator--a7287167-11ec-44dd-b229-722f917de255", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1f8591d-e633-42a1-9559-169011f7c9a5", "sighting_of_ref": "indicator--cb69ebaa-fbdd-462b-b4a5-3a71e0c2c3b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb410440-3c51-46e0-ae54-db2bb5d7a07a", "sighting_of_ref": "indicator--c1d48673-8380-491d-8392-3c88dde2166d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32157498-86bb-43d6-81fa-1e2ab643042f", "sighting_of_ref": "indicator--5278e7ec-04e3-4a19-9f4c-3138707acb53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a09a2e4-0e10-4912-917e-667b85b79f9e", "sighting_of_ref": "indicator--0048a846-b742-403e-b219-1fd364b021e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d1052a-49c9-4a01-b16b-c30b61824faa", "sighting_of_ref": "indicator--58d2011c-b788-423f-a549-69596dc7d625", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cfc6423-a149-4545-9dfc-0ac8f7013a4d", "sighting_of_ref": "indicator--3e0f6ee3-c19e-445d-8e22-5f38aedc1472", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b10a94b0-02bd-4fca-9832-2f0a4f6df21f", "sighting_of_ref": "indicator--06552465-c16e-43fd-b4d8-88b0ebfb465b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966986e2-481e-4465-b979-c67ee002ef19", "sighting_of_ref": "indicator--7bc3df3b-2414-42d1-a3b4-1de2a218d850", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--795678a5-bd07-4335-9417-e5c8e4868175", "sighting_of_ref": "indicator--69aaa9f9-81d5-4935-a37c-42f9ea5a9783", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec14bf6-c983-40bd-9c36-4aa24136d02b", "sighting_of_ref": "indicator--35ad87ed-b875-48fd-9481-679e4d096b6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--120c8864-f2c9-4519-9991-76ea45631ee3", "sighting_of_ref": "indicator--fad9898b-ea09-42aa-9e39-5533082dedc6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1427a93f-83e6-40c3-a6de-d302301ab85e", "sighting_of_ref": "indicator--5e411511-974b-44bc-94d1-aecdca8c551b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ea3be40-dfcb-4f7d-a59f-14f5f36f4a61", "sighting_of_ref": "indicator--93d4c8d3-108f-474a-a235-903e75d852b4", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ed10ad-fb60-47c1-a9a9-228fdbd50b41", "sighting_of_ref": "indicator--c46e6a79-6e35-46a3-bb30-3094c099aa59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2cb586a-e186-4868-a075-9f77e3d6749d", "sighting_of_ref": "indicator--29a0b695-4a42-4e23-92f0-0448050863eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec7c612-a55a-4736-a58f-d40770c7522c", "sighting_of_ref": "indicator--f38d4590-a712-494c-88e0-5fe6948a5810", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94269639-6591-46b2-bf06-aa113ce739a4", "sighting_of_ref": "indicator--b6544054-5c4a-407f-9e5c-b90cf54b2359", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91539d2d-9666-4401-a589-632802f2414c", "sighting_of_ref": "indicator--f756ab65-6009-44b0-90bf-1f7cf04efbda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--115e759a-9e47-4bfe-8763-4327e7161bb6", "sighting_of_ref": "indicator--41c45d61-087b-410c-9dff-ac804522096f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52d29495-0de8-4c0f-87d6-4742ca67d51f", "sighting_of_ref": "indicator--fa96f6fa-7c72-4ae1-846d-971a82c91c43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--259dd40f-a96f-47f1-98c6-c68abb11d829", "sighting_of_ref": "indicator--c4d971e9-3945-4651-b56f-e217f57158f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f1d01c-9cdb-4416-8fc2-66c8aeef16b0", "sighting_of_ref": "indicator--55fc8dd8-95f7-4aa7-87ee-d1a44b8c8574", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b6f9be4-ef72-4e27-8cff-925b8623af19", "sighting_of_ref": "indicator--18025092-9953-40f3-8dd7-0be1d5ad55ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c9e14e-1387-401e-a41b-6cbf7df49525", "sighting_of_ref": "indicator--b2d0e516-ce58-443d-9947-e2a0fddc171b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a03bd9e8-1786-4a3c-bfc1-40181f076a13", "sighting_of_ref": "indicator--db0b018e-a2f7-45cf-b263-094fedf6852d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8137b94c-e4b8-45c6-955f-cc4bf940881d", "sighting_of_ref": "indicator--6a3c7d21-dfc9-488b-b4de-956a01997902", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533a595a-0024-4f53-a04f-5fdf4ec1e073", "sighting_of_ref": "indicator--444545b9-1bce-443f-bd56-d39bf05ba6e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754bbc5b-fae5-4754-9f5d-27cddd8f23e5", "sighting_of_ref": "indicator--3ef9905c-a710-4924-95e7-8e13f654b611", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3cc833c-30ab-4fc9-aa73-5106efa83bf6", "sighting_of_ref": "indicator--1527b31b-7ab4-4c5a-a23f-458c5ba30626", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dda140ba-c003-4040-aa57-44f64a226279", "sighting_of_ref": "indicator--bc331fcc-71f4-4eb8-bd08-79e16fb8b227", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3107ebe1-23b8-45bd-9673-2d4515610698", "sighting_of_ref": "indicator--6a0b1bb7-d7ca-4d90-9ac6-42d742898f87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6b352e3-ad9d-4ded-91e1-1a39de94c49a", "sighting_of_ref": "indicator--9f9d48a8-d084-4632-ae55-b6db1e366496", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f91ebb7-4668-4346-bd29-7ace96d5bdec", "sighting_of_ref": "indicator--dc22ca97-022e-4e45-8391-2cbbdbd25450", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8282c18-38c3-4696-b0bf-ec77101995e4", "sighting_of_ref": "indicator--ebf92949-a6c1-451c-9353-ece68b07c2b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08aaf651-2c30-4b1e-82f5-fac7e7343e9e", "sighting_of_ref": "indicator--532a93c6-987f-498d-bc6c-190ec34e202e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b945350e-e7ed-454c-8fac-c123bf007d45", "sighting_of_ref": "indicator--d09be411-16c5-44da-aa7d-eefd9aa34c0f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de85780-f040-4f3d-a9ee-f5e446d0cc04", "sighting_of_ref": "indicator--6f4483bf-5021-431d-ac94-78ce7b4e77dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--614f63ad-c54e-4332-be3d-c4079b3cc0af", "sighting_of_ref": "indicator--61fac150-6770-44ba-8e7c-c966f9d57a92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55361dc2-ba45-4ba4-8952-60fc99f18ca9", "sighting_of_ref": "indicator--2a81dc00-2753-4a0f-8b59-15d74c8c2205", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd426115-a0c5-4c20-aeaf-88d515053ff6", "sighting_of_ref": "indicator--8bcac53a-010b-4fb7-bd81-b0db380154fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c417316c-1456-464b-93c9-7958deaa4fae", "sighting_of_ref": "indicator--bdb10af2-bf72-4fbf-bd31-0841e47275b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df3f3076-f1a9-4f6a-b181-699685a7f523", "sighting_of_ref": "indicator--a539b212-0c88-4df0-abf6-faab97fdf9f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a237fb-6c94-4e42-87af-69eb1cd6a677", "sighting_of_ref": "indicator--0b7eb113-fc6c-400e-820a-cecb7f194357", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--222f87a6-47cc-49e4-9f24-a123c8adc920", "sighting_of_ref": "indicator--83b9c499-7d9e-4a10-a0c1-7fec853c6d8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bef626c-e0ca-4a36-99d3-70a6489f229f", "sighting_of_ref": "indicator--0a3530c3-68d7-42f3-b324-d5e4a0599d43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa4d443c-24f8-4bc8-8681-7e7a7fdc90ad", "sighting_of_ref": "indicator--ff0e4876-4e61-499d-a6a4-6a1401dc5900", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582fe317-82c3-4d40-95e1-fb6040578982", "sighting_of_ref": "indicator--a6002f81-86fc-48d0-9e03-24b976c23e3e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2cf9d6-3d07-4c4e-b237-f5070cf1500d", "sighting_of_ref": "indicator--f42f560d-eb36-4376-a22e-e1f9df3aab53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcaa7211-adf4-497f-b3a6-3bb5b3b87489", "sighting_of_ref": "indicator--38beb37d-502e-4875-9eaa-f7c4b5152f66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1856d7-d150-41af-abc2-0d944118ec84", "sighting_of_ref": "indicator--19201c2d-6b18-402e-91fa-f6162ad98d4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23e68616-b06b-41c0-bd75-651adb2ba357", "sighting_of_ref": "indicator--6b56e25d-2087-4e40-b279-8a2dc5f10f22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efef9e62-4337-41b7-8344-b85f679813da", "sighting_of_ref": "indicator--c934ddad-b0e9-438e-bbe8-3ff1762792cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72da73d3-824e-489c-97bf-f59f5a7450f0", "sighting_of_ref": "indicator--8ebe54cf-dca4-4e0c-b16d-5c97e2e9c020", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cce8d83c-4753-4e62-a6ff-fc38c9c7e866", "sighting_of_ref": "indicator--f24012f0-370b-4987-9479-f8510a8f64fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c28ac3-308e-44b0-a514-a305c72a7464", "sighting_of_ref": "indicator--8481d018-34be-460f-a4e0-6c77730ea577", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09b45741-05d1-48f1-a5ec-557235dedc27", "sighting_of_ref": "indicator--25dd5bd1-2b59-4de0-ad7b-faaad1781068", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--385c9abc-354e-40ae-b951-a99d637e9f0a", "sighting_of_ref": "indicator--715fd75d-fdf1-4a21-ad9c-2eb2ca97ca2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6979438-7bf7-4f7b-9c9d-3ea0c271e4aa", "sighting_of_ref": "indicator--084d12df-fd2d-4f76-a455-d2f69fefbeff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b3125cc-6492-4ee1-828a-108111ba3d28", "sighting_of_ref": "indicator--3d668376-b88b-4118-8ec9-fc8261f955fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6528cf96-77fe-4ffc-9d8d-7ea9b541ab7e", "sighting_of_ref": "indicator--2cd681b9-cad5-4866-973c-606e7d9f9e6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3505248e-e94b-4116-905a-d5f855b6eeb5", "sighting_of_ref": "indicator--2c06195d-7b04-4e19-90bf-126d3dddb8d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aca07c72-b6ca-43c3-90e2-c6023a9797fb", "sighting_of_ref": "indicator--e0e10ffe-4972-43f1-b3db-838d0e015c38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--998e75c7-e97e-43b4-bcfc-cbbca4ce047a", "sighting_of_ref": "indicator--cc3a9fd7-b57b-4a84-a7fd-df44e6b017a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b09fe3-2f78-49bb-86c5-139ff141ecb5", "sighting_of_ref": "indicator--a3dc09c2-5261-4194-84b2-cfdfbdfa0c16", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf1be8a-b145-4650-b326-94b45cf187c3", "sighting_of_ref": "indicator--e7deeb9e-aa9f-41c0-8e56-48fd61d341bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de03a2a-9013-4a8a-8f83-728c494de6c6", "sighting_of_ref": "indicator--86a37d0f-b4cf-418d-b5dd-aae0e106fd0d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abe29a9d-7e7c-4178-bc68-0a20e9aaeba2", "sighting_of_ref": "indicator--8abe4d06-950e-48be-b1c7-1ea12c947b04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16144bb-1844-44d4-b6f3-0b9685f73637", "sighting_of_ref": "indicator--faae5899-3618-4fba-bf3b-71d6acb5f0c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42b1507e-877f-4ed9-9fa5-0d1883761cac", "sighting_of_ref": "indicator--bddf403b-9ef8-484d-89cb-9b6712984454", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5affcf26-7a8f-4303-ba16-b5ebcb4093f9", "sighting_of_ref": "indicator--569dc9e0-f2f1-465b-966b-0703c081397d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ef87b8f-8138-4dc6-b474-56340b0f258f", "sighting_of_ref": "indicator--64950a44-42c4-427e-80b5-f1f0226fb8e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9555ac34-ead9-497e-b428-fdc30bf4dd1a", "sighting_of_ref": "indicator--1f72317b-f534-42ec-8f2d-2d078abe0541", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78aa2fbf-6d2f-486a-a23f-c4b81f5b1b03", "sighting_of_ref": "indicator--4720ce4e-e18e-4a2f-90fa-e4c422682c1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e35c7235-8b3d-414b-9b75-a842397c76cd", "sighting_of_ref": "indicator--06e9c21e-9327-41df-9574-4b5dcf576362", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4506dda-6e1b-4487-9b14-fb0e6f3d4d14", "sighting_of_ref": "indicator--7e07eae5-2cae-41eb-815e-42bf5cc9da7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cb0fc79-84b2-4b0d-b4d3-96396b71954b", "sighting_of_ref": "indicator--e503bafc-1c7b-4fcd-8583-1902f6f76b80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e37950-7522-4890-8372-6d4e48d7fe10", "sighting_of_ref": "indicator--9a8dec81-2376-4ba0-9d24-e67d7a398f2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d00b9b7f-c144-4d7a-aa6b-52de938d9c87", "sighting_of_ref": "indicator--530e4527-6669-4be8-8f37-af4fc1e29263", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa9a0c41-13f6-4128-a2ee-ea157f535d98", "sighting_of_ref": "indicator--4db47651-c2a5-4659-a3a8-a43cff9ed104", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeda0406-cc7e-4144-9e60-f7967aa1fa6c", "sighting_of_ref": "indicator--88bda15c-5e51-4d2c-87fb-eb6cd11ffb1f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac7b3ff5-a64a-4076-8574-e22c3be2f9ac", "sighting_of_ref": "indicator--48655f68-f405-4770-8760-4cd4265026b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d64dda-9583-43a3-bb94-087f8c127c4b", "sighting_of_ref": "indicator--2212a9f3-b4eb-4cfc-8752-9a7f57da6ce4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a66d9d5-a5b5-409b-be49-0b272867b509", "sighting_of_ref": "indicator--34efe5e9-24e9-4c4b-98b5-c09ecd966a2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d82521c-574e-4a5b-b44d-71718ab323b4", "sighting_of_ref": "indicator--4591cd66-3a6d-468a-98c3-623af880c3b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682762ca-63f3-48d1-9198-9852bdbf23d7", "sighting_of_ref": "indicator--0dfa8f99-eafd-4b82-a64c-118f7c5ac9d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee96605f-3b93-431e-8ec7-3cebc7d8733c", "sighting_of_ref": "indicator--373e54e3-6197-47ea-a541-c5cdc0aa8b05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac6cf5f9-4ff5-41c4-8024-9b73a24b7990", "sighting_of_ref": "indicator--f938baa9-1201-43d2-b3cb-4088b9cdff78", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77607ec-a00c-4a5b-81f7-79ece784d46d", "sighting_of_ref": "indicator--2ce19518-e82a-41bd-a4fb-ff8b69a419a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd8e6a4-7ed4-4195-825b-45cb1b39b926", "sighting_of_ref": "indicator--3205b4f8-39b0-43c9-be7b-9f9664f0d4a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19b5babb-c56f-4d16-84f4-75eb16989f05", "sighting_of_ref": "indicator--7e782a37-f9a6-422c-ab79-023a2cdb6205", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bdcb8d4-c34e-4700-84f3-cc069047a1ea", "sighting_of_ref": "indicator--870f40bc-4f4e-4e79-b599-816be93c12c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41b08ce5-981b-45eb-b2f0-2943d25aad08", "sighting_of_ref": "indicator--5eae7155-dafa-421e-b5ee-608b5d4373bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7442794-ce71-401c-a6c2-ca14f836915f", "sighting_of_ref": "indicator--a59dfc9b-ee13-4ce0-88c5-5ca8eb40c27d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1436a3-240e-461b-a17a-1512718fbd21", "sighting_of_ref": "indicator--fe67693a-4d0e-4898-a92f-44152052a5c1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40860b52-24d4-40fa-9a34-f4039892d852", "sighting_of_ref": "indicator--c9a92f5b-9e15-47b9-9fea-5b81dedb07b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82449cfc-ba69-40f9-a60c-61d928d7e0f3", "sighting_of_ref": "indicator--c7e751b0-f582-421f-93ed-623d5bc345d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e725fef-f26c-49d9-be6e-d5c753d81ba6", "sighting_of_ref": "indicator--4c3ed6c9-2c28-416d-84ec-e09fb2dbec5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cfbcd06-103c-48b8-a027-aca730519ace", "sighting_of_ref": "indicator--41cc01b3-ad09-4391-afdd-213cac9b26c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df74b867-c345-43d8-b019-d414957d79fa", "sighting_of_ref": "indicator--0038f3ed-477a-463d-b265-409710a2e151", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7018c5-3fef-446d-be0f-e823ac39fb1a", "sighting_of_ref": "indicator--045156f2-a9a0-44e5-b23b-aba43691fb29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc29b5d8-d7d4-400c-a913-2a1f9ea0b595", "sighting_of_ref": "indicator--e0760e4b-ce85-428f-a4d0-734d09bae1d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d174b68-cbde-4e67-83ed-fa35723a61ee", "sighting_of_ref": "indicator--6d461164-6425-4b08-8c27-bea3d1157293", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48effd8-3867-4d3d-a5ab-11df9aadda77", "sighting_of_ref": "indicator--ee670c17-e884-4bfd-a16d-6dbb8dc2b97d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeced2f4-22b5-4bf6-a78e-b9bae45ca88c", "sighting_of_ref": "indicator--a03558f4-2d66-4045-86b8-e82918772eca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c1d1aed-0fae-4576-9624-eaadbc3d8eee", "sighting_of_ref": "indicator--5442ea7e-72d1-47cc-b11c-16bbf6972e26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51938438-db1c-46e0-99e1-81af39e4425e", "sighting_of_ref": "indicator--2aed9ea8-8a75-4db8-a612-f8d2b3e80528", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--717e34d8-6e3e-477a-bdef-e9c004aaa1a0", "sighting_of_ref": "indicator--276b424a-8512-482b-b1c4-cea2af844a19", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb3194d5-02d0-45b2-9e11-ad19f62535d9", "sighting_of_ref": "indicator--d3fa1875-b630-4b07-9b8a-e3e0147c1fb2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59261911-ef23-4252-8cbf-37d14f015feb", "sighting_of_ref": "indicator--6fb49a60-7bbd-4dd4-89d5-58fb8dc78b4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e26c270-397d-48c0-ab77-43233dc66a6b", "sighting_of_ref": "indicator--77dc7a2b-17aa-437c-aa5e-245861d0002a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eaf9fbc-bdce-41b4-816d-3a479aea2505", "sighting_of_ref": "indicator--dfb051b2-2bfc-43d7-a379-c17f0455a690", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2077be-60ff-4ada-a3a9-3a58fe5bae64", "sighting_of_ref": "indicator--760fd798-49b5-470c-8eed-03b8a5774b95", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e963805-329e-4652-9648-af94065e7b52", "sighting_of_ref": "indicator--c29f4d43-99e0-4254-abec-ee11496cab1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ff6f65-8817-451b-b1d8-61064e928293", "sighting_of_ref": "indicator--5e1e1f50-59c3-4a48-a8df-028f5d36f797", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e51902-6cf6-415e-960b-e7782ab199ab", "sighting_of_ref": "indicator--3aa0489a-5f19-4555-a9c5-bc710f1e94c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41d5ec91-2039-407d-8d66-af092a09917d", "sighting_of_ref": "indicator--4e2f0f7f-b40d-4368-9df1-60f9f283fd24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09b797e-a322-4f4c-bb19-c7e80385f41b", "sighting_of_ref": "indicator--2dc7997e-9096-4317-979b-b42defebd48a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e707b3e3-0294-4139-a6c2-f7c002008117", "sighting_of_ref": "indicator--711aaf46-2e39-448c-a526-b623448ac1d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda552fc-688a-4a77-8114-f9979d8a0604", "sighting_of_ref": "indicator--0943197b-35c4-47d4-b213-a59020211838", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60361fac-ea1b-4e3e-bf48-25e549cc0568", "sighting_of_ref": "indicator--4f27ca33-fbae-41b1-83a0-0121a2a9401e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5183a36-64cf-4bde-b9aa-580750439aa5", "sighting_of_ref": "indicator--3af2e76c-eaf2-4218-b627-f28e31ac2170", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a04eba-a318-4ebb-8d19-bda25797ef91", "sighting_of_ref": "indicator--a866f0de-84d9-493f-841d-bb7c318c3deb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54a7bb90-026f-4573-ba99-9268f64906fd", "sighting_of_ref": "indicator--ba98c19d-ef48-4581-87f0-71ec81abea21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4f2222-e2d9-4c82-aa6d-1e05df5ecf46", "sighting_of_ref": "indicator--80c592b2-30f3-479f-80b9-e31b3f4c1826", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0b8c2bb-79fb-4000-a5d7-dc4d89622f0c", "sighting_of_ref": "indicator--17a3a9ea-0dfd-4ea1-95e0-b67d69db5c14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb73054e-e007-47f3-b0d1-fc4c58f546df", "sighting_of_ref": "indicator--18a438ef-21a1-49d9-966f-7b7053ed952f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0566c72d-3912-4de0-a293-5490ad469ff7", "sighting_of_ref": "indicator--2ed7ff9c-5fde-4f55-9438-644523a09a8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cea84ad-b7a2-4264-8268-3eb3225ebfc3", "sighting_of_ref": "indicator--e3dd2490-c0cf-4e1f-aa44-b47b0ebb6d57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fff4df1-89de-4eab-80d6-afcd98c12272", "sighting_of_ref": "indicator--05d72ebc-213f-4516-97ea-1f6cdf69c72d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b801871-3147-44b8-8f93-99bcfab2752c", "sighting_of_ref": "indicator--dd2d02a8-61e4-42af-b5c2-6594598bd050", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb5e639-83c9-453c-8d7b-196d9b932a68", "sighting_of_ref": "indicator--b32bc3d9-f386-4660-8739-720df3b81578", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829260f5-c6bd-417d-8063-f5cb1544ff61", "sighting_of_ref": "indicator--de4b0a42-05b3-4bb1-be63-761faf547665", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd7a7577-36be-43ae-b7ce-6d057ea3037d", "sighting_of_ref": "indicator--cdd887b9-35a6-41c2-9e98-333d223011e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7d18222-dfb2-48a9-acf0-23e1b88c4fa4", "sighting_of_ref": "indicator--e3b92912-5d45-4c51-83a1-f9002247834c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93934a8b-dcd5-487f-94b0-03b254f647ba", "sighting_of_ref": "indicator--be7dccb8-a1b8-4a73-abbc-8be3e6fc6b5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8256970c-a38c-4f88-84c7-11830346842b", "sighting_of_ref": "indicator--5ff3ccb1-42e9-46ed-b998-f2d43e3d1592", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a1026ae-0cab-4e68-8dd2-745cebca2fff", "sighting_of_ref": "indicator--6a5f0557-00bf-4ae9-afd7-cea628d1ecd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae6e385c-ad55-452c-ba61-d3cc00f5ad9a", "sighting_of_ref": "indicator--166f7c21-cca8-454d-abaf-d11f8aa0f0a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6425a9d0-29df-4924-a5d6-3046bb381c34", "sighting_of_ref": "indicator--1b9ed10e-09dd-44a6-b2a8-d4e3cc386839", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--992fc76a-3eca-4469-8f2a-78dec62db86a", "sighting_of_ref": "indicator--5df19ae1-3429-4b32-af2a-3a7d9d27e0ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4ddbc8e-f294-49d4-8dc7-9fcb0356cdd5", "sighting_of_ref": "indicator--fd3b2f4b-be3d-430c-88c4-cba2845022f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3da4dc6-68bd-43bb-9a12-8b408a80790b", "sighting_of_ref": "indicator--0c200712-e0ac-41ef-8733-7cad277bb977", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54859a8-b264-4028-aa8f-58c0b6aee09e", "sighting_of_ref": "indicator--21baf17d-cb05-4399-821c-a1a77b72ef8a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013f5935-4156-43a5-8494-6a54453876bd", "sighting_of_ref": "indicator--416f305c-82b6-4f98-a848-f995477d10bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff2c5cc-42df-4d0f-a34e-80844791e632", "sighting_of_ref": "indicator--dd27710b-a1d5-4a86-8402-b5ae820b114d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f209e1-2ea1-4301-8403-964041791313", "sighting_of_ref": "indicator--6ec81f5e-6958-4769-898d-8bafb47376a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96378570-b3bf-4647-bd44-eebc7f748705", "sighting_of_ref": "indicator--1dd1114a-8849-4026-9b5e-7817ac21c816", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--037197f1-446b-4e4d-92de-e68cc1a77b4e", "sighting_of_ref": "indicator--bb7923a1-6c8b-4d1a-b20c-c11023220116", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f77dea3-8360-4ca2-8582-2c22ec08309e", "sighting_of_ref": "indicator--a6f659bd-8b86-415d-bdeb-f5211f57b5f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f568d7-70c5-4ffc-9433-1fc3c05a8562", "sighting_of_ref": "indicator--db32e611-8fad-4e4a-88c6-e87b5b781af2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81fbd4aa-3f59-46be-ab30-4ed549527221", "sighting_of_ref": "indicator--06964fd4-aa95-4baa-bdb4-a1d81af82077", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a79a5b-4ba9-4885-aa3d-41be32b4ee66", "sighting_of_ref": "indicator--c9b2d4a9-d285-44ed-b897-81ce9f97c6d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--936ef4c1-8322-4bd0-93c3-ee09037c7301", "sighting_of_ref": "indicator--ba9b82fe-997d-4d11-9eda-f0887b641c83", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e283202-2ee4-4ba2-a10c-731d15981270", "sighting_of_ref": "indicator--c270c17c-f9ae-45f8-b0e8-1c4ca0c39e6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--644e05db-5b97-4870-bb4a-8cec36155139", "sighting_of_ref": "indicator--4e24a574-da95-4b7b-8ab2-8e1034639241", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9801e64f-3800-4abb-af89-89f9ff73dbd5", "sighting_of_ref": "indicator--e5e6eccb-15cd-4c83-8558-dfeacf97ea83", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446be738-c949-48fc-9409-7f0c766f96ca", "sighting_of_ref": "indicator--58cdec4b-edf7-4fe9-b7ec-16283a7b18b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--737bc136-ee03-4fe1-85f0-85f6e86cd59f", "sighting_of_ref": "indicator--2447a8bd-4bef-42dc-a59c-42a508b49153", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efa1df41-3cfe-482f-9eeb-9100c35d4a46", "sighting_of_ref": "indicator--bcc7080c-995f-4170-831e-03e76d3d60fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e31e32-a349-44b5-b730-f78202f5191b", "sighting_of_ref": "indicator--1fd09a0d-a6c8-4057-a6ad-f907184f6009", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--650ec589-0d8c-4a3c-868d-65938bd44f37", "sighting_of_ref": "indicator--92f09011-f113-47e8-85d3-8f52365d1849", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e252f7e6-9174-4ece-96c3-2aa63bf39022", "sighting_of_ref": "indicator--28c63f8f-7019-4c59-a6cd-f5e7dd64ffd8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e86f464-30b2-49d6-aadd-48557ee02da5", "sighting_of_ref": "indicator--d769c27e-394a-47a9-9d1d-7b0dcdab1c5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39fd09be-4fd1-49b0-aa64-1540dc248906", "sighting_of_ref": "indicator--c94a39cc-6eb3-4553-b5c7-9da8f1fd4616", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f8f9baa-d9ae-47c9-b34d-597bde118ade", "sighting_of_ref": "indicator--99b3f57f-9307-4c2a-9bab-4cf8c61eb03f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7b34fe-241c-49a4-a90f-fe70b90e5608", "sighting_of_ref": "indicator--14eb3147-669c-4d21-ae3d-0a042d7f48e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bcfe261-b35a-4843-ae31-5ca8601df483", "sighting_of_ref": "indicator--be439283-6817-4f3b-996e-03f14364730f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c2b84eb-91c6-4da0-b3ef-d81430c429bb", "sighting_of_ref": "indicator--663aee28-31a6-40f1-9d8f-37ad0d531e78", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e71f47dc-9290-4209-97df-afb71316ef8f", "sighting_of_ref": "indicator--20e4d212-ed28-4fec-aa40-3b59ce043dfe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae5fe60-8043-4b5a-85f7-ecb07c94eb77", "sighting_of_ref": "indicator--82eaf7b0-c930-47c2-9748-74c02756dbe1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae0caa96-a244-4b34-8bc4-3a873c2a721e", "sighting_of_ref": "indicator--71063604-f2dd-45b9-a941-feb269171699", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0cbaba7-b61a-4932-a8ef-a8b74d785934", "sighting_of_ref": "indicator--a7d8a199-572b-406f-be1b-dcff3df143a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eeae22f-adaf-4949-b514-9a1c01420332", "sighting_of_ref": "indicator--f8df2433-3624-406c-b82f-dba12f382feb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c973c8ac-e12f-423a-9aa4-d875f94b85a7", "sighting_of_ref": "indicator--4ac8caab-dc9f-49a8-94c3-edaf245cddb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5229077-2d5e-4c88-b78f-1ee3c1505ff9", "sighting_of_ref": "indicator--09b54287-d092-491c-96a4-f9ebe2f35718", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e3ab7f-a826-4d77-979e-d97567429b55", "sighting_of_ref": "indicator--32c01d81-5ca0-4b0d-965d-1cf3ca65d553", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1cf74e6-936c-4a39-b691-3be95eac0e09", "sighting_of_ref": "indicator--0db423e8-6781-4093-8400-b60916ec702e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e2af17-55b9-45b8-b9e9-c7762e8c815a", "sighting_of_ref": "indicator--3b3f0662-2182-4786-8f4d-0b335d39120a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a1d628-74ff-4601-8208-4d28b949f531", "sighting_of_ref": "indicator--282e4154-3ff9-4dda-8f91-ee68c4753ffa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--373d6249-8f34-490a-9f26-118f31a8c44d", "sighting_of_ref": "indicator--741894ae-339d-483f-99b6-1409ed0d63f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--201e9943-7d12-4648-b50e-8cb13ce36afb", "sighting_of_ref": "indicator--21830925-a100-490e-8f29-d20af7397a8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7080f0f-12bd-4579-9757-fa87b3cd7051", "sighting_of_ref": "indicator--c382e206-70b1-4f30-bc10-760e6b1848db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc262071-e9dc-462c-bb6f-01220432c764", "sighting_of_ref": "indicator--6881b229-f2e4-4c34-bfff-fc626895b519", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8be23c7-ee53-43b5-9dd8-d7203942b14a", "sighting_of_ref": "indicator--47fe2a0c-1f6b-473e-b34c-74a3926eaeea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13f33293-38b6-45a5-92aa-33f722cb5525", "sighting_of_ref": "indicator--b4548eca-1cac-4873-87e2-6eebffdc4477", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5c69798-2b6e-4693-9cdc-ba2c0c17a548", "sighting_of_ref": "indicator--d4251013-6480-4046-9918-c5901e8ed559", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d21cc502-c8a9-4e7f-aadd-e2eed30b0658", "sighting_of_ref": "indicator--6a6d986e-1ccb-406a-9c13-3e1aff33e069", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f31ec845-1846-47af-97f9-a0ab14650bd3", "sighting_of_ref": "indicator--47ef0430-0171-4d30-84d5-1207d7f901b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6b5f444-c472-4f38-922d-28edd58b9494", "sighting_of_ref": "indicator--94a774de-1799-444c-b07e-41b731a6b827", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4b4c4c6-0e3d-4d7e-aaee-70e1f76a0d56", "sighting_of_ref": "indicator--8fa2dd94-99a4-44e1-868a-9ef2cd1a1766", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad02f2a-201f-457c-869f-de9ecad9c2fa", "sighting_of_ref": "indicator--547f79b2-16fa-4b13-a579-991fbcddca75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbccf8d4-2e6d-418f-ae9f-e48aff3640e9", "sighting_of_ref": "indicator--1184fbca-747b-4ccf-afc8-1ba7474e2fd8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63820775-5dbf-4ca8-8f2c-4a80db3d0bdb", "sighting_of_ref": "indicator--86f9a803-2c2c-43a1-afb8-65ae81091821", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796e140f-0127-4935-8b81-55caffc2082a", "sighting_of_ref": "indicator--75b40caf-7410-40fe-a292-10d5903a5784", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bb68a20-9604-4dc3-b9a2-103c41c190b9", "sighting_of_ref": "indicator--ee7e54d1-0b82-46a8-831a-0cae2642924c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d215a79d-7bf2-4946-a787-05f91beb85f4", "sighting_of_ref": "indicator--7e87d756-4162-496f-8cf9-b77799ea1e33", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c53b602-9711-4c54-9507-7f92ab442e5b", "sighting_of_ref": "indicator--e8f4ebfe-a1bf-46c5-826d-27bb221ebbba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3863a8-e59c-407a-b58c-ffee775a58a9", "sighting_of_ref": "indicator--b4befa4f-f8f9-4705-b211-3bd113e2bc68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a4d7eec-8d7a-4124-86a2-c325e74e8a92", "sighting_of_ref": "indicator--f03bcf41-e096-4696-ad54-35f972b0e68c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddfe6fb2-cd34-42f0-a223-0b743a14223c", "sighting_of_ref": "indicator--e4d6311c-7b28-4221-8d49-aca962d53038", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd671416-50ce-438d-b922-f2c01d0a6765", "sighting_of_ref": "indicator--558a7ad5-7389-4482-86d7-4d396a5030a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--936ca3d1-1607-4f0e-b82b-fed4bd7a0a7c", "sighting_of_ref": "indicator--116240db-2469-4b7d-9027-09a0c730372e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5f7e940-8624-4c09-81dc-1d492bb9de5a", "sighting_of_ref": "indicator--580d093e-39b9-46ab-8091-54de62c4cc21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f0c7a6b-676b-4bd8-9a54-9b8780b3e861", "sighting_of_ref": "indicator--a174f5d8-8a87-4675-96ef-4ca9953fe3ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b74581c-af0e-4835-9884-830f57afe219", "sighting_of_ref": "indicator--3a064230-057c-47e0-a4fc-9e359bc5c968", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4bc271-b32d-4737-b96d-5b479fbd470e", "sighting_of_ref": "indicator--68d201de-9ec2-482b-846f-1de568f6bbb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a36314-4ef7-4acf-a0b2-038ac1d27be0", "sighting_of_ref": "indicator--45a3ce7b-614c-4e3b-8c1f-a55073917bcb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8da01686-6634-48e8-9057-fdc10eb5dc93", "sighting_of_ref": "indicator--d4ea5c9e-20fc-4e6c-8aa2-8be0e52b69cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aea6981-c82f-4f7b-b55e-470bc5a83f7a", "sighting_of_ref": "indicator--2dc4ab8a-df3c-4672-b15a-524c800480e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696aeb25-beac-425c-b813-f2a71a8c7f82", "sighting_of_ref": "indicator--1a21769e-5266-4f75-821f-7b604bab473a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce67a4d2-767f-430c-b6b5-7aaf44595878", "sighting_of_ref": "indicator--d619774c-993b-4761-814d-0e165cee960e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ced328-459d-4711-8289-7994854a9aaa", "sighting_of_ref": "indicator--e2692274-3b32-4a3d-b1ae-aaeeb1631b00", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--280a5195-29bd-4758-83a2-df72007ad813", "sighting_of_ref": "indicator--6da592d4-12b4-4fc3-9855-4f40ea48ecdf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7794dffd-f1f9-46d5-bb38-c1a3b4eabf8c", "sighting_of_ref": "indicator--3717f0f2-b736-4c8d-8738-9156f60c0c5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52954369-359d-4e89-a15e-cc6870320025", "sighting_of_ref": "indicator--0a0899a0-acf7-4da4-b859-63088586f975", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f3dfa4-d47f-49a2-a120-09643f998135", "sighting_of_ref": "indicator--8afaf541-0961-47a2-8115-02b450bf8eda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--486d4fe2-a5d5-4199-9a01-179638aa76b0", "sighting_of_ref": "indicator--573bde41-805b-4f23-8038-a0a0679fe341", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7530135-1a93-4944-a52d-534bb1a0a7f0", "sighting_of_ref": "indicator--94991cf0-3678-487c-b85a-16073e6d6d76", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7cedcd-f17d-4f95-b8fc-f48489bad5f6", "sighting_of_ref": "indicator--f8e2d6b4-e328-420f-be50-e9b280892fcc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcc17f17-89ba-4f33-9ced-ce6d32d22f61", "sighting_of_ref": "indicator--5116cf1e-21cd-4e7f-ba15-5c6dda03f469", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0816ed7-6471-4551-a586-5761a29ea944", "sighting_of_ref": "indicator--15d4d235-cbe5-44f4-a1af-4d853f5b07b9", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abb721e1-1c9f-46cc-a0a5-184b4c0b173b", "sighting_of_ref": "indicator--67728f5a-46db-4c9d-b829-9a3a1c475584", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bea94fad-9a9f-4461-a4a1-310cda18d1c2", "sighting_of_ref": "indicator--15fbfb34-07ad-4a13-a09c-b68a6d405ad4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49387a7e-8d31-42a4-ad39-f381acf02405", "sighting_of_ref": "indicator--e4a9a994-85f7-4668-9f8d-43cd32e03a58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7795ce70-7c80-4aba-bec5-9dd0731b40cd", "sighting_of_ref": "indicator--0e662f14-0b8f-4e64-b612-ec2add1959ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c6059f1-a545-4b4f-8f48-6aeedea4bb4e", "sighting_of_ref": "indicator--0e662f14-0b8f-4e64-b612-ec2add1959ce", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480d4eac-593b-42c7-935d-0de06172a0d5", "sighting_of_ref": "indicator--7d994ad1-b7ec-44ed-a33a-49cfd34aafdb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94df5ab-ead7-47ea-bbdc-27e1df44fd19", "sighting_of_ref": "indicator--50004bc2-d2eb-458e-bb91-ef08bde9d602", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c604da3f-8814-47e7-b2e0-0ea68458013f", "sighting_of_ref": "indicator--4ba4924a-35c9-45fc-9ac6-454762cbb641", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a868bd66-e3d8-46d8-a6f9-f682918c2a09", "sighting_of_ref": "indicator--b640d619-a5bf-4114-b77d-d85947f200d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2c25b8-e49d-418d-bb3b-3243ef6f291e", "sighting_of_ref": "indicator--57a7bfc1-d48f-4291-ba49-5a43213b798a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27426783-fd00-4971-be76-a4e519a32423", "sighting_of_ref": "indicator--547bdaa3-d026-4c25-bf48-41d2e085e3f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d3aa923-9745-40c9-aa10-967ed69f109d", "sighting_of_ref": "indicator--6281a8d3-d8ca-49b2-b906-21a438566a9f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d3ba9a8-dde8-42b0-bee0-5ec75090dfbf", "sighting_of_ref": "indicator--9a1bb383-82fd-4d66-86c5-b31279ac87b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d44ba1ab-bff1-43c8-8b1c-d1bf59c39ad9", "sighting_of_ref": "indicator--1e09fa5c-53a1-4f7b-a9c0-8143d668cc4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b741c72-fd6d-44d0-9db1-9851105e2693", "sighting_of_ref": "indicator--2290a549-0751-4ee9-b0f8-de4d8152505f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77a04f0-a269-42d3-a481-80cef2d21441", "sighting_of_ref": "indicator--8aa1c5f3-0b41-4abb-804a-5a15ce48e5d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--176e5a67-e116-40c1-a036-e3aefdab4230", "sighting_of_ref": "indicator--7db78e1f-49a8-4ad0-a058-11df7b1a0a40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--349db090-d6a1-43e7-83e5-3362fcde6f34", "sighting_of_ref": "indicator--ff6d4295-84a2-4e01-90b1-f0077e902bcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--487898ff-a9e9-424c-aee5-7abe588884a7", "sighting_of_ref": "indicator--ef3db052-9195-4f9c-8321-90ae4b67521f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4038609f-916e-4817-88ae-d8e204cde50a", "sighting_of_ref": "indicator--ab09940f-4e11-4033-8e2c-ff706b33245f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fff5bbca-a292-45cf-a69c-2e5531a5f87c", "sighting_of_ref": "indicator--5c2a404c-84e8-473e-8aae-f1855700d556", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e5267de-642d-45ee-8449-fe1122686602", "sighting_of_ref": "indicator--3e637a24-62c7-4cdc-b21d-d0ba220eb004", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e2a5592-4416-4f68-81e0-4b0f2d4be93c", "sighting_of_ref": "indicator--d11232ca-98f7-458b-bd6e-702a8e207077", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef4a519-9288-4717-8c70-2cd524355578", "sighting_of_ref": "indicator--d2a3beb6-1a38-4daa-9d29-2a04618be3a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7d1e7d-3064-40d7-ad55-77eb3240e458", "sighting_of_ref": "indicator--3a3befdf-f479-4c8f-b916-a4fc8f8fb08c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d1e780-b58d-4b76-8528-e52adff3bdcd", "sighting_of_ref": "indicator--3b1e338c-c8ce-4b83-8d7c-56e0255fd1aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e89ad6fb-5c5b-48b0-8cff-d3ff869825fa", "sighting_of_ref": "indicator--11e1fcde-8f2b-44cf-8d03-ce45ab496e49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd65816e-515a-489f-a391-f7f7059c8c39", "sighting_of_ref": "indicator--14071da4-48b5-4ff8-ae26-25f651734157", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcbf0e6f-cc98-4d7f-b5ff-1e6c0f26f820", "sighting_of_ref": "indicator--e164e894-114c-457c-a562-e233a3c7bdbc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--180eb2c1-064d-4f62-b089-b2f108311487", "sighting_of_ref": "indicator--ff5130ac-ab17-4362-9d54-b9730ca194ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7657a9d5-2f08-4850-b34e-c78bbf1d3edd", "sighting_of_ref": "indicator--f70a196e-eb70-447a-913c-92a4f65778d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e05113ba-458b-46ab-87fc-6148531af5a1", "sighting_of_ref": "indicator--cdc7be02-2cc8-4cfd-8bad-c676c42b21b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8e16cc-b67a-40fb-8fa7-fbc2a22616da", "sighting_of_ref": "indicator--a1d9801f-fc94-45b5-bf8c-ee57d1ab489d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e082b53a-754a-469c-8003-555c15f50a45", "sighting_of_ref": "indicator--16358e49-8180-4839-8f73-68c199f9017a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9f14027-677d-4db4-bc86-d8f72ef9d9e8", "sighting_of_ref": "indicator--b63e1b38-d45c-467a-97ce-96e8c564deaf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89c7b38-8978-4e56-be01-dfd354450fa6", "sighting_of_ref": "indicator--84ead3dc-64f0-4585-bb77-b996994a51f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--469acf8b-9f68-4d6e-aa40-955419b7c3f4", "sighting_of_ref": "indicator--e411458b-38ca-40a9-9c13-3621b29cf3d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--117dcc17-6cc4-43d3-97b4-89a47217bd7c", "sighting_of_ref": "indicator--94f6929c-eb70-46d9-ae34-78220a731107", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b5667a-1df0-466d-ac5c-d26cf472e31d", "sighting_of_ref": "indicator--8f2ef56c-16c5-4f44-bc61-752583d88468", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e8ed3f1-0c76-41af-b646-d2784d1665aa", "sighting_of_ref": "indicator--5a5738f5-c180-4614-a711-467d12751d07", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff296e88-b5eb-400a-887d-ca7ac1b14453", "sighting_of_ref": "indicator--ee1f6dd8-2c48-489b-9522-6b83cbe3a894", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1d91442-86e1-4614-9bd5-b6b151af4afa", "sighting_of_ref": "indicator--08deb22c-4616-400f-81f3-51c270258356", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3572ae26-7119-49c6-b70e-31e2aa440e94", "sighting_of_ref": "indicator--dbb81720-03d9-46c1-ae9f-3f08e863cde3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17cf130d-cab3-4109-8c3c-bf0e3eca67df", "sighting_of_ref": "indicator--c2c237d3-eb53-498d-bb99-4b4a7422103b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb4fa2a0-4095-45ed-9f54-af0cbcc67f28", "sighting_of_ref": "indicator--8f5bb007-2b0f-43d6-b109-d792bd08bc28", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a612c703-0f1f-4f4c-ba51-fe57d9447141", "sighting_of_ref": "indicator--413bba96-147b-43d5-a9ce-5b6116f52147", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b1a378-10c9-44d7-a9e3-8658b15b0989", "sighting_of_ref": "indicator--0b334c02-02ff-42c2-bfb0-dcc803637316", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa9202ed-ca08-4d90-8325-91e32f813b8d", "sighting_of_ref": "indicator--fdc79906-cc2c-4859-adbb-e6a18ce3b0fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ac669b-bcce-4690-a388-fa282c267ebb", "sighting_of_ref": "indicator--4a4b48b8-e1d8-4696-ae10-e22bc927e302", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea345f91-f6de-472f-82ba-3031cb6ece9b", "sighting_of_ref": "indicator--19ecd9ec-da17-4883-9ae4-fc56d3938d51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6ac09c-00f8-452a-a8ba-f7b97c91a4a4", "sighting_of_ref": "indicator--b2bfcd91-3d35-40a3-ae70-5c136f3743e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9011f49-5a6b-4fce-8ada-3d4de69e9373", "sighting_of_ref": "indicator--c08b6685-10e0-49de-a1e7-782e44d9c1cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d138e5b5-596f-421e-be98-794e4d0f3a61", "sighting_of_ref": "indicator--0e04c257-9423-45ad-a9e3-be4f02b2ca83", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d1d1c0-dd56-4b48-899d-83aaa8ee33cb", "sighting_of_ref": "indicator--41580b7e-342e-4e6f-9662-72c3b00ddd4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12c43194-0be8-4603-b48e-7cf9e3e776e3", "sighting_of_ref": "indicator--7b29ffa1-e1cc-409f-b57f-89cb1c9d4eff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b3cbf0-1f50-4247-b3bc-4ab65e9f30d7", "sighting_of_ref": "indicator--c04d1976-6904-4f8d-8658-0de73499389a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3338dcfe-afb6-44ad-84e3-a5ec12046e29", "sighting_of_ref": "indicator--ee2ce5be-07b4-4ba6-b931-f35afec076bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a98263-8cbd-4e8f-919b-87c53cea3916", "sighting_of_ref": "indicator--3993b67c-7d36-4ca0-ae86-7a296123edf0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727108f0-1b29-439b-bd65-d0621b258281", "sighting_of_ref": "indicator--23ccde5b-d62e-4376-8b88-1d5ebc9f1a94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdea1dc-ec90-4f03-88c2-7150d5332eb9", "sighting_of_ref": "indicator--d5a8d32e-fd58-4390-a0bc-a99ce4ff3c53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7590daf5-8608-4b02-960e-da6d9074b985", "sighting_of_ref": "indicator--8d45773d-9bcf-43d4-819f-e442e9d95927", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd07def1-062f-4f02-94c1-991ce52e806e", "sighting_of_ref": "indicator--f051a7d0-f13e-4d2a-853b-e48956f80f16", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52e882a4-e79f-4dd8-8a1b-024ac44272d4", "sighting_of_ref": "indicator--404a22f7-3a22-4f0d-a8b3-a8cd73839bef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7813d78f-a6ea-4069-8bb8-614cca6d4641", "sighting_of_ref": "indicator--1e146029-2ca9-4dc4-95b9-ad137ed1202c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86994b9c-c1e0-470d-8c07-9c1cbb1597d4", "sighting_of_ref": "indicator--d6d41f1a-7d94-4ed8-b408-0f5bfc973560", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f45da41-7041-4667-be37-57cb778acac3", "sighting_of_ref": "indicator--b2bde2c2-43b6-4ee2-ab69-41b4d7e3e0a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0628184a-eda6-4d45-94a3-35a7c972d36d", "sighting_of_ref": "indicator--27bbbc8d-36a2-4637-bffa-a9ed6efbab9f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb8c0243-c2c6-4305-bf1e-bafe004e4240", "sighting_of_ref": "indicator--b797ff5b-d90d-4bfa-a5d9-5230d69a1260", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777be642-497f-4147-accd-569462707786", "sighting_of_ref": "indicator--3c8a23af-bbd8-4a3a-8832-b40e9df1d6d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dcea044-ab14-41e0-aed7-353f42b59bd9", "sighting_of_ref": "indicator--d40ca271-a23a-439a-80bc-5897f0fa4e07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91ad9ff9-04dd-4b57-ac98-6c1550e6bac1", "sighting_of_ref": "indicator--6c4e413d-6bfa-4e5b-8bbb-44b43827fb1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bd1effc-236f-4571-b522-1d720646acbb", "sighting_of_ref": "indicator--70c4d849-b5b8-4185-9010-f4af4f0218cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a0b1e5-e508-4f0f-9d1b-8059875a5627", "sighting_of_ref": "indicator--27503f02-8ee8-4219-99f4-701847b34712", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44514f8b-6437-4da1-ae33-8732d2464601", "sighting_of_ref": "indicator--2685d92b-36ab-4a2d-b479-f33072dcbd13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165ec620-8439-4749-9cdc-d91d20cacd3c", "sighting_of_ref": "indicator--ad4a8770-bb2f-4742-9bbe-c7ae51db7760", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf181246-28f5-43c1-a5b9-1783e08534b8", "sighting_of_ref": "indicator--c90c7067-25b5-49ce-b7f2-932934475724", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f938025-6bb2-40a2-9eb8-3d72bb65d8de", "sighting_of_ref": "indicator--02c4e3df-79cc-48e3-90aa-9d8b4b2e01db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--525947dc-0cfc-422b-a220-924241446126", "sighting_of_ref": "indicator--7815f4a2-9229-4c38-8cf2-8cc913265a30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27157bd5-590a-4e51-8177-35318552df59", "sighting_of_ref": "indicator--843926f6-2ce6-4a98-84a4-eebc81e96522", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b6cf40b-9b11-4acb-aac2-cee1fdedeba5", "sighting_of_ref": "indicator--e7c69206-c223-4210-85b5-42cb6c3f9ecd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--751e4291-77b8-473c-a0d7-9715ddd423b7", "sighting_of_ref": "indicator--dd4baa3d-08d1-4edb-98a9-dde98872a60b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c680212e-342f-42ca-b5a2-14b7d0a39d10", "sighting_of_ref": "indicator--9b178a80-70ac-4aaf-8cb2-4c58508a070c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--387a1fa7-be54-4084-bd87-2b815d5b6a6d", "sighting_of_ref": "indicator--c41d96af-cbda-4bdd-83f9-efbc8ec290a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ddfe1a0-3ed6-4d0d-8d46-dbfcd696d194", "sighting_of_ref": "indicator--2ebca072-3962-4614-b0cf-7ba1520e2506", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b9ccde5-9100-4c89-8251-252b8548e769", "sighting_of_ref": "indicator--9a73668c-0ae7-4239-baef-c34c27b9631f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbf9f646-0cfb-4141-a0fd-d8cf28958d41", "sighting_of_ref": "indicator--3884457d-9527-4e07-9e1f-dfc5adf346bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8183cec8-5b8e-4252-8ff0-329aa7dcc154", "sighting_of_ref": "indicator--4d95005a-7c67-4eb8-b120-baf2cf5e1cfd", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9abaa20-6b5a-4ea6-9ce0-5ab8ff7e14fa", "sighting_of_ref": "indicator--66d97483-6b92-477b-b4c7-8fadf20c1046", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d62c775e-abfe-4920-a22e-7b85b65d9cae", "sighting_of_ref": "indicator--044dc7fd-9879-4d99-a5ff-9822cbbfa81d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b00b3c-6305-48a3-98e1-51a211087be4", "sighting_of_ref": "indicator--3b509d30-e6c3-44e9-8385-5d33f612fcb4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a59b1d-1f02-4556-b7e1-2b961b3ecbb4", "sighting_of_ref": "indicator--a1befe6f-6218-4ee7-b18d-8e86d58aea92", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcfd9f4f-eec7-430a-b693-3ebb96280a9a", "sighting_of_ref": "indicator--7f2590b1-50ae-4e2b-8ce1-8fa4727390f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f85217-0490-4376-b524-cb1dc6ac221a", "sighting_of_ref": "indicator--9789424b-ae0e-4fc4-a29f-908545eed740", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cbfe77f-9067-4b5b-85ed-e94d91dd7fa6", "sighting_of_ref": "indicator--b337d525-19f3-4f88-812b-329965f1eaf0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e31b040f-ffec-416a-a568-f5637123ec5e", "sighting_of_ref": "indicator--db4f1c6f-1d54-477e-9f51-7e843df247a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61d80664-396f-4caf-b8e5-85baea59b655", "sighting_of_ref": "indicator--272d50fb-7ad8-44f9-a617-425c7ec4e1c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71b1eebd-d888-4467-bf57-4a18dadee050", "sighting_of_ref": "indicator--eaadccc2-f5d0-4314-9363-b128368ebfd5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a7940dc-02c1-4af9-bfce-d284e55e3092", "sighting_of_ref": "indicator--26d225c9-4f9f-49f2-bd2a-9f0c7cf621cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cc0eb3a-ec7f-4ba2-b6ed-5f3924773912", "sighting_of_ref": "indicator--e1a99543-f8ca-4d4f-b157-ec72f24efcd1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d19ecd9-54ea-4563-b97f-cac6fe1730c8", "sighting_of_ref": "indicator--e7c88d47-7f53-40fb-bb9c-a7442b186af9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d9e37e4-6429-4217-b2be-5d1b74e57936", "sighting_of_ref": "indicator--442c3669-8be1-4a98-9e67-7fc655364cf3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f7ce5d-544f-43b0-b24d-00a282af2e73", "sighting_of_ref": "indicator--9ddd3f07-d92c-45c0-be9e-7709dfe71fd9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--661b0b9c-a3cc-4980-bff7-1d600b479654", "sighting_of_ref": "indicator--c0a461ff-b1dd-4874-bbbe-2cc7f19f7b29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a04f639-4143-4ee2-bb45-cd0b2125f994", "sighting_of_ref": "indicator--09230a8c-3744-4c81-adaa-307008bb89e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4bc1d27-82e0-44ca-918d-6ebdfb96275b", "sighting_of_ref": "indicator--9606dd52-775a-49fd-aced-41f2bf0a1b94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3626b6-b280-4dbf-b467-280f6c8b2df4", "sighting_of_ref": "indicator--585daf88-1655-4ed2-be10-68a3d26320fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcbe6246-78fa-47f7-b71a-8ec1ecd2fdab", "sighting_of_ref": "indicator--89daf3d3-ee69-42c6-9f9c-d24794d5c9d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7395ded-358f-4ec1-9c40-b9f76c24f90d", "sighting_of_ref": "indicator--3b5da0bc-2acf-4243-8ed2-f6906d7873a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f0e3b6f-2332-41ec-a8f8-d2c1f9555b75", "sighting_of_ref": "indicator--e7677244-b69e-43cb-a3b0-bb6f06b7a577", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5559d12-a3ff-4028-837c-4e7c36a4f173", "sighting_of_ref": "indicator--894c791d-961d-4361-a289-e9b7266a70a9", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cfa2379-a54b-401c-910f-1d55c68881f6", "sighting_of_ref": "indicator--3d4b1aa9-212a-4a94-aeaf-e99e6a763d59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25587470-a08c-4d36-8a07-300117245bcb", "sighting_of_ref": "indicator--aa084a3c-0207-4224-b22d-c2a1b845c445", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7f534d7-309c-4575-b7a9-eaf0a4866c8c", "sighting_of_ref": "indicator--8796c0ad-ee6a-44ce-991a-8d933553f5b0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f416d6d0-795b-478e-91e8-4463001cbabf", "sighting_of_ref": "indicator--c43e203b-78d8-4add-a0dc-6a184e43cb19", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d16df8b2-244c-4b92-9b71-8deda43773bf", "sighting_of_ref": "indicator--94c62b65-bb99-439b-94d1-97355bd3ef69", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db98bf77-02f2-4f3e-9dab-6964f8745045", "sighting_of_ref": "indicator--b5427ad8-43bf-4835-9bf3-c262e023f558", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71201f9b-5fec-4735-b33c-279b722d3a25", "sighting_of_ref": "indicator--3c067421-db72-426c-8c54-c45018ef2972", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe99de2c-ae41-4ac5-9cd5-a8f45d549ed3", "sighting_of_ref": "indicator--dde0a19e-1c00-4cb1-89a9-de8df753a0ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a1eab47-313a-432a-9e42-45e25b691f45", "sighting_of_ref": "indicator--c760f7c2-4be7-40ff-ade1-752054da7202", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c325a70c-ea46-4065-9470-b00928ad3d63", "sighting_of_ref": "indicator--60e7ebf4-6be5-4713-b271-87119bf6cd80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0b0a37-efc7-4a34-95d1-e90be2dea6de", "sighting_of_ref": "indicator--56cfadc4-11c4-4c9f-9714-08af71872114", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2982f7e-9a6d-40e9-bb4d-a142947a2a0f", "sighting_of_ref": "indicator--9456c2ae-8071-4b68-adde-66c4db443e90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f08f802-2d54-4c09-9ef8-fe02aea4a49a", "sighting_of_ref": "indicator--380d6003-d366-422b-9376-263198e13a68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47188cfe-f6d5-472c-b0ba-8ad3529f3aeb", "sighting_of_ref": "indicator--12cec4fd-7606-49ec-a146-931ce0e67708", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23120785-7586-4cfc-9502-7b300b12e819", "sighting_of_ref": "indicator--d5cd7d86-c25a-467b-bec3-7e4cc7e4d943", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbcd3b11-e4c6-4eb3-bcdd-8c12c56e4778", "sighting_of_ref": "indicator--3b98f916-6706-4c01-b893-9c86c376547e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bda5278-2f56-4b8a-98ca-29d1c81d4d3a", "sighting_of_ref": "indicator--e3ef1e0a-7aae-4647-b2e5-060be26f2b03", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1685e819-7a47-40da-b86a-074d7f2b0b1d", "sighting_of_ref": "indicator--f5a4ea6d-fada-4c4e-af66-582db10b44fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1b5a4c6-ce4f-44d0-b70c-6ba616843cff", "sighting_of_ref": "indicator--773bce9b-4435-41d0-bd07-9f23bb3d69c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52a5871-73ae-44a9-8e92-cfcca2c0e8ab", "sighting_of_ref": "indicator--9618c073-93c9-4a76-87ba-cc8d33c1381d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0809eca-939c-425f-82c6-6c65f9abe4ba", "sighting_of_ref": "indicator--b5a82112-e73f-4a14-8e0a-1b317fe27a06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0d076f-c41a-493e-b5bc-02819e138d7c", "sighting_of_ref": "indicator--ac1e07f5-0a45-4fc6-9394-450725cf912b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95dc7487-2bea-485c-803a-4b47c364aeff", "sighting_of_ref": "indicator--4885d8ca-b983-47e2-ba6c-8f234526de8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcf8fdd5-6e3c-4e1f-b256-076e30a28ab6", "sighting_of_ref": "indicator--44c4804a-d604-4ff8-a56f-da0beb45e337", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--770cceb0-c88d-47bd-87c0-be7c60dd6682", "sighting_of_ref": "indicator--5fe5eaae-c3e3-4520-becc-1163d47a7f5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5fa59c9-364c-4500-b1c8-1d42d81f34f8", "sighting_of_ref": "indicator--a50abbca-710b-420d-88b2-10be56b79cac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca2ed99-4bd3-4536-8605-0a54f72b7d88", "sighting_of_ref": "indicator--61e1d4e1-c0a5-4c20-9ddb-a5a8e36bf86b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ffc24c-cb92-4492-ad86-6819159ab9a5", "sighting_of_ref": "indicator--f6e287f2-fa6a-4675-9a9d-f229df1ed98b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef02c1cb-d569-4b3c-a57a-86112fa219b3", "sighting_of_ref": "indicator--afad0bbc-0b81-4249-b164-ce464c3c5761", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--853e591e-9294-4e5f-9346-afa5f1d1dd05", "sighting_of_ref": "indicator--cc0f517f-84a5-48fd-8629-cbffc7c18568", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eedf6e5c-0d8a-474a-a4c5-bbeb2d5a3c9d", "sighting_of_ref": "indicator--a68cd76f-5a6b-4819-8fd2-a73d800f1f75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f515a34-9902-4616-a14d-98e2edeae9fe", "sighting_of_ref": "indicator--4c6fa8fd-a3d4-41de-a204-0f3dbfca008c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed70926c-ec5c-48db-8b0f-c9bf2f62d982", "sighting_of_ref": "indicator--46fc195e-e087-412f-aff3-2984f5bbfcac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1420b425-3b68-48e1-9a44-c8b849b40559", "sighting_of_ref": "indicator--94ba1c3c-4ad6-4881-9fbb-6b1e2e89b853", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c53f518b-d05a-454b-b46c-2e67091230ec", "sighting_of_ref": "indicator--5013d6c3-8dd6-4e65-9f33-1ac8ba0964fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f3b987-d04f-49d6-9741-2e41166581c3", "sighting_of_ref": "indicator--c9ec4561-b4cf-4cf6-b415-d703c61d3f86", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db8c816-07cb-4645-924a-8f59b41a4f7c", "sighting_of_ref": "indicator--3ff06c89-9807-460d-b38b-6bfdf564ea2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08bd94de-47c5-46cf-b15f-c7221168dbf2", "sighting_of_ref": "indicator--2a306500-58ed-437d-a77f-997426ef27fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ad7ea57-9880-4dd9-ac84-ff7666e1bcee", "sighting_of_ref": "indicator--43bef25c-64a8-43c2-a842-990933f8740b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7620ce80-33d2-4e04-885f-1817588595e2", "sighting_of_ref": "indicator--35251dc8-4195-4c6b-a93f-1b2c0998b0e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df117de6-67bd-4f0c-ba53-9927ef60018c", "sighting_of_ref": "indicator--bb8031c0-8b2b-4e39-9325-0f5d26d26e10", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5053789d-97be-4e8d-b9ad-48196d497368", "sighting_of_ref": "indicator--fd597871-40cd-4b8c-91cc-bd26e5bcfd02", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--942bdfd9-1756-4dfa-b4af-159bb2a3dc5f", "sighting_of_ref": "indicator--42a8d7fa-957b-45ba-9e04-af94875f3752", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f71ee81-d010-48b4-920c-57e0f61ce235", "sighting_of_ref": "indicator--80b719a6-4f08-4fa9-8f65-6a7010c23035", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deecd584-da39-4811-ac23-02b2b71505dc", "sighting_of_ref": "indicator--0ff7bf2a-74d1-428d-98e2-c22cf5a12cb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df7006c2-7949-489b-afd6-a7561b5646d0", "sighting_of_ref": "indicator--6cd569d5-57d9-4871-a8e0-96421d862521", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f8defbb-3ec3-4f8c-a412-33ea3e5294c0", "sighting_of_ref": "indicator--bf6c52e4-07d0-4199-9977-4f77fa73a525", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a37b42-de23-4b14-ad0d-6882a420d6be", "sighting_of_ref": "indicator--163550ff-bf52-4dc3-9c17-04d07dce410f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae46d09f-4e83-4747-8953-e05b4422dd56", "sighting_of_ref": "indicator--63f69c9c-984f-4fe1-9f9e-c366bfde712e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41382980-7a0a-4197-bdf5-34c6d98768e5", "sighting_of_ref": "indicator--db75b11f-fa55-4a00-aedb-7b99604d6a26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd984d3a-0fa0-40b0-8ac2-05ea038c2c0a", "sighting_of_ref": "indicator--67cf3213-6ba9-42ca-92ab-f00d75d41d13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe9c1078-3ff0-4862-a676-df50878f5e3e", "sighting_of_ref": "indicator--5da1f9b5-1f95-4153-8f78-0a97d5576d55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f07b7870-3326-4a6e-8eae-edeb3430ba79", "sighting_of_ref": "indicator--06ff55d0-1539-48ec-88f3-0452829a86a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ebd78a-bf51-4a50-a7a1-a6a0294e69f3", "sighting_of_ref": "indicator--2dab4647-a2b3-455c-a7d1-ab231223c376", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f608f1a8-2eb3-4cf1-beed-bf4d790ed5c3", "sighting_of_ref": "indicator--d39e93d7-b776-4dff-8257-1aef19856f11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298d052d-8bc9-4abc-a558-642eb5c7b03c", "sighting_of_ref": "indicator--cc0f5820-f967-42ae-a3df-e32b1da43a69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78f1afde-7d60-48ce-affd-9906992ea07c", "sighting_of_ref": "indicator--709d0df5-700d-48a4-a52e-4852320c0939", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44873e73-51cf-4a92-a036-6036ffc4f7f2", "sighting_of_ref": "indicator--688b09e9-8cd5-4d91-a999-aef387f559a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c351884a-0cac-4935-bcb6-6a0383c109dd", "sighting_of_ref": "indicator--170aded4-f089-4913-87d2-b8d759285561", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97cd0fe9-e973-4b45-973f-b298d741b8eb", "sighting_of_ref": "indicator--93e36dc1-9a80-464d-9aab-258816cd97aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73251ed3-d339-4e6c-822b-998328fcd4b4", "sighting_of_ref": "indicator--b7c07bae-b82d-4ac1-9bd3-e20a41dfde73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b194acd-3738-4ba0-99a3-8799f082ecfe", "sighting_of_ref": "indicator--3daaa036-904c-43ba-b56a-d1dfd15cbca6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30bb722e-961b-4067-946a-3c4b0eb82962", "sighting_of_ref": "indicator--6a8a5b62-9dce-48c4-b3cd-956179a79a91", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d888be-aa91-46ba-8034-ed0a6dd23c05", "sighting_of_ref": "indicator--16a705ce-02b7-46a8-920c-48a2a516b995", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c11c8ea-d149-4811-8664-9abf26505136", "sighting_of_ref": "indicator--5e6129db-81ca-44e0-8a87-ef9dad062b22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--623ca00e-8c18-4299-9cba-aaabd2b79ce0", "sighting_of_ref": "indicator--2b88c8af-267a-495c-827a-de4a41694042", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51b1f692-ec9d-48f2-a048-a7b49e90b43e", "sighting_of_ref": "indicator--d99c2165-a0a0-40e2-97a6-95ac23ab5153", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f331c74-9cf0-4d2f-a480-90a596495c08", "sighting_of_ref": "indicator--f9aabd20-a238-472c-9276-be98b925046f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f170bb6c-7ba3-472c-8292-a919802a123c", "sighting_of_ref": "indicator--978014fa-2c11-4e8b-a3a5-ae9c1c892de6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d738e7-98ea-402d-82be-0ec17f265b7e", "sighting_of_ref": "indicator--85e12c27-1698-4c47-a9a1-f0b784c197e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48f991c4-e02b-4f10-9d95-bb93926d8b6f", "sighting_of_ref": "indicator--530d7c28-c9f8-403f-9755-f40a5332550d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de33e6f-5f9a-4ee3-8d98-c7162431102c", "sighting_of_ref": "indicator--7639a240-8971-4970-bfbb-4431ab1c3c7b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b287ced0-8a3d-46de-91ee-9ccd44683a5e", "sighting_of_ref": "indicator--f1fdd76f-03bc-4fdb-ab6a-54fcd52a7f55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb9ac71c-688c-436b-bc7b-67676a754ed3", "sighting_of_ref": "indicator--c546734d-9b18-4941-b88c-6da0cca2637c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f67386a-1308-4beb-8559-9dbe8ee4cffd", "sighting_of_ref": "indicator--90b04378-6cd6-457e-a72e-780c712cac2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f51d0225-a0f0-4598-a4a5-7bd5e734937b", "sighting_of_ref": "indicator--1e6320f6-4d65-43ec-bc40-c737b7c11c22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52911ac2-ad1d-43fc-bee4-5b0371b1ef27", "sighting_of_ref": "indicator--2bf280bb-6a97-476e-a317-35ac7e429a2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b666d522-d67e-4515-9efa-37efcc4f689e", "sighting_of_ref": "indicator--6e7fd0d8-11e9-4f20-9851-872536137bb3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c621530-5993-4f8e-990e-d4874bb3de66", "sighting_of_ref": "indicator--fd42fe18-44ed-44c2-8545-c7583944f53e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475c70e2-c0d7-43cf-85fa-e4e476565977", "sighting_of_ref": "indicator--67298bda-14c7-4618-bd4a-40a209104db9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0be0f3fa-c91f-4e78-86ec-ca1e486aa25a", "sighting_of_ref": "indicator--a622f766-4fb1-4b2a-a471-8555db96f323", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--171d25b4-7419-4d8e-a821-3084afa99aa2", "sighting_of_ref": "indicator--b1a3ee1a-3ab5-454e-8db1-4e33e48e4f6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--718089fb-9bf6-441d-aa0c-73ea74aff4c3", "sighting_of_ref": "indicator--a2faaddc-85f2-45fb-af14-8b1d9edfd82f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6278311d-5418-4964-a5f9-5317a64d62eb", "sighting_of_ref": "indicator--17132ec8-733a-4dab-a54e-b2adbf089661", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81b1aae1-d402-4014-8001-a7673f724efc", "sighting_of_ref": "indicator--ce6c4555-4f9a-4ecf-a259-c0dbd4a50ec1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3822e1ad-2b81-4a39-8bbc-e3cf6bd2cb62", "sighting_of_ref": "indicator--baf857af-15d8-4f4c-be4a-fdb1b72a6501", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cca189b-827e-44a4-9718-b9568385666a", "sighting_of_ref": "indicator--099ac778-beb5-43b3-a9e2-1e844aae5dd9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c09627-7756-4d0e-beb8-f27878e76064", "sighting_of_ref": "indicator--4e683b80-9d37-4072-9cb5-cd57365f80e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf8f6d7-bdbd-4d41-af07-8de4b434ff16", "sighting_of_ref": "indicator--7ad93b43-9f24-4d8d-9de3-354198400ebd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ef6a241-01b8-43c6-814c-e46dea7ff511", "sighting_of_ref": "indicator--4f93b734-a318-48ac-b459-acb508d7d9d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2b7a6fc-01d4-49d0-adbe-85f96d1c7bec", "sighting_of_ref": "indicator--9b19954c-a74e-4c1e-b2de-b22d25be9f10", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efefa377-6a35-43d1-baa5-2a8e9d08a45e", "sighting_of_ref": "indicator--935051e4-1e29-40bd-9c2a-243b1bbc1c8d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--345996ae-a417-4906-a764-1c798bfa7fea", "sighting_of_ref": "indicator--2c558f6e-4eda-47e1-8080-156451f3cb95", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4cf7759-0355-4729-b8f6-83685e91fe57", "sighting_of_ref": "indicator--74611759-1d5b-44e1-b705-6feb36a2f39c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05066417-0df7-488e-850c-7f08ab6252f6", "sighting_of_ref": "indicator--e1d141ff-76de-41e2-8f9c-1b19291925be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e10126a-7a6e-43ac-bc71-b564fdd90225", "sighting_of_ref": "indicator--901ac5ab-70d1-43d2-ade7-1760c24e513d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd490ca7-b9c6-4b28-87bc-e91eb0882cd1", "sighting_of_ref": "indicator--c99692a3-d95f-415c-8354-af40f41c9b4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4730970d-2576-49c7-91b2-cd618f3f1787", "sighting_of_ref": "indicator--1a57cdbe-614e-4624-8729-2807a2b2c510", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--419fee31-f88e-482a-831c-c65d4ea6e87b", "sighting_of_ref": "indicator--9d3f995a-b99b-4554-b534-352dd1e4f088", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58393acc-ce8e-4a8f-99d1-cb8d0bf699b1", "sighting_of_ref": "indicator--1249e762-182a-4a43-b8dc-4549f165d50d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc58ca1-47a0-439e-bb6b-93c916572227", "sighting_of_ref": "indicator--2aa4abec-5997-419e-acca-f7251d06e2e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15d3fd8e-fe5c-42f8-8dfd-b0917694c2e7", "sighting_of_ref": "indicator--79e33c06-7126-4b90-be53-b2e069dd332d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a76eaf-3d13-4bb2-95a6-6f67b707ef6b", "sighting_of_ref": "indicator--c241bf4d-e77d-4b13-acc8-35af8a5ffcd1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b43ea33-715d-44b8-9288-15587aadb54b", "sighting_of_ref": "indicator--2b479a43-d49c-436d-8197-5f27df119500", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a6e9363-9667-4394-baaf-69e8b5f33608", "sighting_of_ref": "indicator--b1198473-ccb6-458b-91cf-d54abac54e37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cddb9b-4209-47fc-87e1-f6f37463c903", "sighting_of_ref": "indicator--eb599c9e-044b-4480-9ab4-28cb55b2c82e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ac8bcdd-4c80-4dfb-b712-72404e6f7d87", "sighting_of_ref": "indicator--67c3b5bc-1398-45f5-b2fc-5bd105db118e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9dabb27-75f7-44b7-917e-7d8e0ca57dde", "sighting_of_ref": "indicator--b4ca491f-6644-4823-a46e-0b94bae17600", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2643fb9f-222b-41cf-bbd3-16537a8d51b0", "sighting_of_ref": "indicator--e0c56a43-8303-417b-9805-66ba6feec08f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ce1dcfd-3fea-4789-a251-8c579871bd38", "sighting_of_ref": "indicator--ffa86fe0-5450-45f7-a354-f674c2618a39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91b06e64-3ecb-4f6e-8d24-218ded2ddc8e", "sighting_of_ref": "indicator--0a281b50-04d1-4aec-9fd1-9d79ff8264f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3b2be19-eb3a-4029-b1b6-ccc381069f0f", "sighting_of_ref": "indicator--9a5c1ab7-925a-4182-bdfc-01fd0a201e27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9485e7b2-7a45-498c-9975-4a30a31bb7d9", "sighting_of_ref": "indicator--8f41e43c-a73e-4014-b029-36195a821a1c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95ee1183-b061-4c88-9f46-db723e076c73", "sighting_of_ref": "indicator--ec172b7a-a23a-4507-b68b-eee7f4a57cef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577a9966-ab44-4391-8c5c-3b21a5571a0b", "sighting_of_ref": "indicator--244d425d-1d15-4455-9cc1-444058cb1d50", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f6de309-e9b9-4637-a2eb-5698ea3a2696", "sighting_of_ref": "indicator--ce21b547-a51c-418c-9883-b38bfc91a083", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b3655d-b9c3-4f96-a3f3-a0626101a060", "sighting_of_ref": "indicator--5b900a81-0034-4270-a197-e6cf545d67bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d1a51c-cb03-4f55-bb7b-e850307200e6", "sighting_of_ref": "indicator--d6895ef2-def6-4ac5-a7e7-4b016ef96afa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--722ef993-2a44-4584-9ced-2ca9ce07bd17", "sighting_of_ref": "indicator--6343e3ab-770b-43a2-b527-97d4acbb4cbd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffc2858b-3590-4cd2-88a3-b6e3d8465707", "sighting_of_ref": "indicator--c4071eaa-b080-43a8-8865-188fc8db0c84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba2a1bf7-0325-44a0-9667-d77db23cd2e4", "sighting_of_ref": "indicator--6d7df0d1-0e68-43ae-bfc5-15d1987b34d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--772f6435-6c88-4777-9f92-e627879456eb", "sighting_of_ref": "indicator--3f55e9f8-c403-4469-9a3a-e5d1e30a5d0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c7f154-5c3a-4bfc-a3d5-49df8a250c68", "sighting_of_ref": "indicator--885a0c81-4018-4de5-bbcc-c4d5f3ccb039", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec82110-e9d6-453e-b136-4dc3eb48d240", "sighting_of_ref": "indicator--c4550510-1c60-4aa4-8754-f7ec130a0f53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0830bd0f-8031-4012-8edd-19e0c3e1d3b7", "sighting_of_ref": "indicator--5b84f997-daa9-474e-be41-3d6780304f47", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75f4bac6-98da-4914-81f2-f2ae40f72c68", "sighting_of_ref": "indicator--5daac41f-08c1-4fe7-a9f5-e80b3b62c440", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3546468d-7463-41eb-a46b-11e07d22dfb6", "sighting_of_ref": "indicator--0d5e0d82-d74e-42bd-bb70-5bd7cbddc474", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae30bcc0-5c89-4edf-902d-1c48500f2023", "sighting_of_ref": "indicator--7eafd7b7-5239-49f3-b8ca-1fd13d205a17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77a87a38-5233-4762-a173-8ca0c743257a", "sighting_of_ref": "indicator--d8f70f26-69a7-421e-9bc4-4589743f0f26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e43e0570-2299-4a37-a980-b355a2dd0631", "sighting_of_ref": "indicator--4c81806d-5cec-490f-b410-2c2c0a17a4d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--250c848e-b83c-4bf4-9957-cf1cd8e710a1", "sighting_of_ref": "indicator--b6c4551c-2654-44dc-bd8a-642b3acd15fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d5d779-6df5-4e96-a20a-626c9c1c41d3", "sighting_of_ref": "indicator--6941c644-c997-46e9-b21d-fc08a4f74154", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67822aac-5c82-4f96-ae79-589695add030", "sighting_of_ref": "indicator--06603f45-80e3-4004-a00f-7b466604d290", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b6dd724-120f-4db0-9d60-ed5e3fe342c3", "sighting_of_ref": "indicator--ab01f007-7bd6-4247-8947-cbf8b6c28755", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15b7b91-24e3-40b4-9e1d-25c9712673be", "sighting_of_ref": "indicator--438622a5-e076-4410-a4fa-f5c847283d63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbbde9d2-5299-450a-9e9d-a4d2a27a9d8f", "sighting_of_ref": "indicator--13245e95-343c-45b6-ae3f-724ddf5787ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5544d21f-27e6-4095-928c-72976fef11b8", "sighting_of_ref": "indicator--aedf32ca-7016-453e-9b53-50a08cf2b746", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807faf67-f639-4913-b429-c288b82da6f0", "sighting_of_ref": "indicator--05309091-b387-4b2d-8552-165e6be590b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5808a672-eb9d-4969-8e78-c0ae8672444e", "sighting_of_ref": "indicator--4c1775b2-9175-48e4-a545-b084ce9cda4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fdf0ea2-c4eb-473c-87a6-a9462ff603f2", "sighting_of_ref": "indicator--12dc2097-0801-43b3-8344-a34ae128742c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfbdd81-d566-4933-9c45-e321b3286528", "sighting_of_ref": "indicator--a0c6fc55-55ac-423b-9d49-c7630aad84b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ee68c80-9aec-4a63-b516-2911e8b0fd60", "sighting_of_ref": "indicator--7ce72907-4976-4a6c-8cfa-1ca9a128b67e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8b5023-92c0-4bb4-914b-4e41d90c184a", "sighting_of_ref": "indicator--f48b884e-098a-47dd-908c-79782e0adb0c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd4fa6dd-2510-48d8-a484-9f9993895e79", "sighting_of_ref": "indicator--7dd322a9-f689-4edf-9356-15faef89d73c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb4a455e-327c-4c76-aef4-4254bec89eaf", "sighting_of_ref": "indicator--fcf6fcbe-2575-41e4-8dcd-4f3ec5cf4150", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588a319a-5956-4bfc-984a-a033f5991435", "sighting_of_ref": "indicator--46580213-eee9-47f3-af84-2b7ee1f09979", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3452025-2d79-4263-9b8c-ea71b4503c1b", "sighting_of_ref": "indicator--326f37ee-704b-4f7f-bc75-763b39a14cbc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd2cff49-db99-41ed-bd1e-621278368924", "sighting_of_ref": "indicator--33d8e490-419d-4f33-95c6-172d5ca20b59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e135b479-5d67-4d0b-ae52-7e6dccc1ac81", "sighting_of_ref": "indicator--fe8550d8-ffe7-4099-8195-7bf96d1ed1bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249ef196-2e9f-41c7-8f80-3dab8f0ffa48", "sighting_of_ref": "indicator--8e64b199-27fd-4777-bbfe-cf5c3d5e07d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7cec230-3dfb-4f48-9e27-c89a31ee3ed9", "sighting_of_ref": "indicator--7499cc26-f091-46f9-8fae-62ec8bf3e3a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8eab22d-2e98-4ef4-b146-3d9a16aa9637", "sighting_of_ref": "indicator--f77f8a5f-7192-4554-9b83-e1aaf6c6de2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddcf7ff3-16c8-4c75-8197-0cd33084bb8b", "sighting_of_ref": "indicator--322c46c6-aa5d-465f-9aa5-288de4bdd406", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a390c41d-6568-4c06-801d-110ed3467548", "sighting_of_ref": "indicator--322c46c6-aa5d-465f-9aa5-288de4bdd406", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bbb9065-783c-42e7-bee2-26e390a00e3a", "sighting_of_ref": "indicator--d56901a5-2ff2-44a7-8b62-6150578a99e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ac7e27c-bd7e-46c9-80ef-871afe7a25b4", "sighting_of_ref": "indicator--1d8fc546-aacb-4a4a-aa10-df22103d099b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fb21af7-7ee5-43ce-bd77-2c4188fb23d5", "sighting_of_ref": "indicator--91d3ae41-55aa-4698-b9cf-c1d0b10d42a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a7a2a8c-50bd-49fd-8a56-de6f33bf5cfa", "sighting_of_ref": "indicator--5aabc9bf-514b-4e21-99cc-d7725f445c62", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2895fd40-7ae8-47fd-b01f-7bc0d22551cb", "sighting_of_ref": "indicator--13c63036-e8e6-4ccb-8897-7ef4d6c115fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8756867f-458d-49aa-b4e4-90f21ffa76ca", "sighting_of_ref": "indicator--ac87c89f-b4e2-4929-8f67-43808f083102", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5846feef-65f7-44a3-a39c-d4769bb99038", "sighting_of_ref": "indicator--454c4071-ce1a-4c12-8d0b-970f110434df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d1e3dbb-07f8-4eef-a018-c62926613b7b", "sighting_of_ref": "indicator--463dc40d-109c-4f6c-9253-875348b6e3ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f9cced2-25b5-45a5-b7d9-02d51397afbf", "sighting_of_ref": "indicator--2e22f0d6-fa3d-4bb5-933d-69d70c174182", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f072b0a4-4b74-4b45-805a-539c795232b2", "sighting_of_ref": "indicator--d9cde093-0472-45e5-a6ce-a7e5d53276bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2daa1a4-32f3-413f-af24-776d8e5a3605", "sighting_of_ref": "indicator--9262e7d0-0254-461d-9566-0cd1f9f3e2e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36b90f9-b282-4897-afd7-2b57837480b6", "sighting_of_ref": "indicator--b69121a0-924e-4d41-86e2-28d8ee3f9bd1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87017cf1-29dd-4816-95f6-854d85f38113", "sighting_of_ref": "indicator--b4643827-995b-4e17-ae3d-863c9450fb6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65becbb5-608e-41ae-9e9b-bca010b474cd", "sighting_of_ref": "indicator--3cf0478a-38bd-4374-a9cc-08b3258e6d41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f4586c9-0f6b-4678-bd75-bd23cc1d257a", "sighting_of_ref": "indicator--754d1e8a-11b1-4c6f-a17d-210c1add1818", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d0d4719-76ec-435d-91a7-743f775f4ff7", "sighting_of_ref": "indicator--867da7fa-1e75-4295-a0e6-4650049d8b5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77900fd0-66c0-4561-9a03-258041f90205", "sighting_of_ref": "indicator--ce90000e-ae9e-49b3-8bfd-9a7c6c9a0fa2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b66e0756-6273-4012-8441-b32541583678", "sighting_of_ref": "indicator--d5a0869c-ea51-471c-a1e1-f186da1d9c93", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--110bc0ec-5682-4db3-b57d-45a219690946", "sighting_of_ref": "indicator--d054e665-50c9-4613-a6f5-c60b6da36c87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0639608-1269-442a-ad3e-5677fcadcf97", "sighting_of_ref": "indicator--047470b6-67d0-40fd-afb7-b69064e81c73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7284d000-6571-483e-95b6-fbe4e70feb46", "sighting_of_ref": "indicator--b15df675-7ab7-4f56-b4a9-636e726f0e43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cac3028-7367-40bc-a1e4-428ac4173281", "sighting_of_ref": "indicator--cb7416ce-b697-442d-88ff-be1964c27022", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83808d39-4d19-4503-aae4-d13009f5de78", "sighting_of_ref": "indicator--119b5a9c-8994-47ac-a5a2-dc710872a73b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--accb5afa-d4f8-4df2-8aee-4672348c40bb", "sighting_of_ref": "indicator--7e99bfb0-caf9-42f3-81b3-8a24093400ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a72d2b8f-a8eb-48a1-860d-ffd7d429e62b", "sighting_of_ref": "indicator--4f622078-0da9-4781-a318-a1d7dba86b1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e06583d-91a9-4f37-82da-2bfac4e91d61", "sighting_of_ref": "indicator--12d31bd8-ae36-4b02-93b0-4c376d960623", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a792a22-396b-4da1-aea3-721d1d7e1a3b", "sighting_of_ref": "indicator--1a4688dd-ab20-44df-af9d-a242a8315b40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82d8053c-25d5-4d6f-b3ca-d0d347fe56cc", "sighting_of_ref": "indicator--42d89e8b-fc87-4f8b-8ec1-ee5f569d4511", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b82cbef-7ccc-41f4-9a77-8b3ed727f968", "sighting_of_ref": "indicator--44f3c805-c9f1-4f46-a13d-918d3dac6fc0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--758fcc6d-d293-4cd5-b058-5643a28237e7", "sighting_of_ref": "indicator--d8b465f5-080d-4b2c-9029-ac55c438af97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe66bae6-8421-418b-95d5-a60bf8da7a83", "sighting_of_ref": "indicator--77a22b08-decf-4c2f-859c-f4ef52a45f67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae9113e7-97ad-4f7e-af60-2a80938ea41a", "sighting_of_ref": "indicator--0c461de0-750b-45bb-949f-7ff3c59ccb9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a88b4f7c-f34c-4ab7-84bf-3d13544157c3", "sighting_of_ref": "indicator--75fd7599-c89a-4f74-8661-87a00008a233", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b37ffd3b-1428-4a15-8973-6850390c4648", "sighting_of_ref": "indicator--407968cf-a755-4199-a809-ebf9621c2147", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96029925-c9d7-425a-966e-fc6bc7f8c23d", "sighting_of_ref": "indicator--2f76c550-1a41-4f0d-902b-55c1eee36ff5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ce22233-9854-4e2d-8c89-244f9236619b", "sighting_of_ref": "indicator--856b2666-9bc8-4d5b-8bc1-bfb9247fcd09", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0b99f78-a5b1-4b35-a584-cbfe4684025f", "sighting_of_ref": "indicator--90b4c571-641e-4c38-ab95-d533e2d8f51b", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f19292c-e6ca-425d-88c8-4a1017dae544", "sighting_of_ref": "indicator--15014991-f8c0-4441-a866-f2bcc1e2415d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e0cd28e-ed6b-4b50-976a-430fdd721d1f", "sighting_of_ref": "indicator--d3ae3713-edc3-4e67-9c0c-8615e953f1fe", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1072ac19-dbaf-4f13-b162-2af17d5e73f1", "sighting_of_ref": "indicator--6d95566c-c219-4cf4-ae69-ae2b3aac878a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30ccab10-6618-4e16-a24c-62c3a58685ff", "sighting_of_ref": "indicator--ab07366f-94f4-40d3-807a-ef8dfc32710e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e89d0f48-58e8-48c1-bec0-ad27667ca098", "sighting_of_ref": "indicator--5e90538f-4076-4ed7-ac2e-008578c62576", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f80a686-2044-44e1-9a10-8abc6d3b51e0", "sighting_of_ref": "indicator--0a2e6a60-ab6d-460e-8df1-d2520bbbaeb3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb95f88e-91bf-475f-9d08-c8b32cbaab80", "sighting_of_ref": "indicator--c117e53c-542a-4ae1-8bf7-2033cf2a6f9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6a8bc1b-48d3-4dd4-881d-b153b480bdd3", "sighting_of_ref": "indicator--9cf278db-61a9-45a0-b83d-8d6e5fa17834", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd3d0ee-8932-4234-ae79-0ad1ad3bef20", "sighting_of_ref": "indicator--6f23b295-4a2b-43ec-a35c-e694426f7d88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc13fdf-1d56-4036-a655-75a482c3e9ad", "sighting_of_ref": "indicator--b1f75a38-04f8-4404-b32d-800acd0f72a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40973022-3bd3-4e71-a4c1-07d1d34e8127", "sighting_of_ref": "indicator--996a0099-0215-4be2-b824-ea918bace576", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2c0340a-651b-42e1-af56-5d80a4eff6a3", "sighting_of_ref": "indicator--cf1c9be7-903b-4677-b42e-f025b832787b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75dfecee-4be6-4780-8f63-bef97e043c3a", "sighting_of_ref": "indicator--a63f61e0-4a46-42dd-b28f-8e2cfdd6b6c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7091c0fb-478b-4f71-8318-908bcc9ed90b", "sighting_of_ref": "indicator--c6fb9cc3-852f-4f00-996a-5a227e67d516", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d0bfa2a-fb46-482a-8884-483d498d199e", "sighting_of_ref": "indicator--ceac4f59-c360-4d99-9c6d-7379ef138cac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d68df92c-b2c1-4df1-aab0-a8e2819fbbed", "sighting_of_ref": "indicator--fa6f7ba0-6402-4e7f-8614-11e962c49315", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa7d465b-a4ca-4850-aa33-31f999f85a67", "sighting_of_ref": "indicator--2b555e07-adec-4548-88c6-634761c220f5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d1b593b-9f77-465e-939b-e22743419b40", "sighting_of_ref": "indicator--e4447313-20fc-46fe-b76f-284127803a6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c541c0d0-90ef-407e-85cc-01ff0f0cadea", "sighting_of_ref": "indicator--d15803ed-b618-44c3-b4b2-44876f5d3542", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca08ed1-407a-4bc7-b392-04ee44a52c02", "sighting_of_ref": "indicator--e88f7b60-202b-454c-bb36-3f0e5855be85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aabaae7-da26-4558-99ba-47ad3aa7fa43", "sighting_of_ref": "indicator--6e7feb82-cbac-4574-a001-b6839250ed27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--962c40ab-c1c9-4653-94f4-fec364ba74ad", "sighting_of_ref": "indicator--52300f42-deac-4d0d-9061-58b75357b2e0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6198df6c-64de-4a3e-b553-aba7d919c092", "sighting_of_ref": "indicator--a944d7e2-de42-4838-bc66-4f08eb623866", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70603d27-972d-42df-953e-79c8d296a054", "sighting_of_ref": "indicator--45f236fd-c045-4561-a60f-46daf8792a1a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88ae05eb-5dbb-492e-ab6e-1c414499093d", "sighting_of_ref": "indicator--290dd6eb-91d9-495b-891d-16d703f877b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb37a057-785f-4171-8491-fc941b69b2e3", "sighting_of_ref": "indicator--fc0c8b5a-a69c-497a-9042-3dc9d8de9351", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0812a1bc-4aab-4bd7-a477-3204df545dcd", "sighting_of_ref": "indicator--ca29fb66-5165-450c-a4ba-71e0784fe935", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92fa4e70-ecae-4f01-aebb-21ec205ec065", "sighting_of_ref": "indicator--f709da58-da0c-4d5d-9a24-bdea9be8d0aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2c0224-cd11-4029-a4d8-c4acac5ae113", "sighting_of_ref": "indicator--0c8b816f-f6a0-4a86-9f98-97810d06d810", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ffdce27-be3e-4156-ba72-d17843b93ee5", "sighting_of_ref": "indicator--0ed45840-e062-4d15-87e8-3eabe822f5bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39172e52-ff7e-416b-88dd-495091f9c3b8", "sighting_of_ref": "indicator--acc7f6b0-0bcf-48e5-94fe-71135cfb070f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--983785f5-7338-4bc1-8ae0-f560de064693", "sighting_of_ref": "indicator--4e5baa87-af5d-443e-9604-0790a6a1fa6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b650a910-6469-4172-b95b-9510c310e81a", "sighting_of_ref": "indicator--cdb4cd1d-0471-4f39-893b-f1ecd0d9dcff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c5cbb0-aebf-44ab-a0b4-e19c8148c379", "sighting_of_ref": "indicator--9217dd49-26d5-4d83-983d-a72b14228b31", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bd67a59-80b2-4a33-b40e-fd437c553f4c", "sighting_of_ref": "indicator--7a6cd69c-e38a-4954-9439-8d8c68cb249b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3159461b-0ab3-491e-92e3-50265dbec2bf", "sighting_of_ref": "indicator--c8b39c70-8ddc-43ec-8e69-d67e0f19fff4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91107f0f-2a1e-4b0a-b025-3493f92203a6", "sighting_of_ref": "indicator--4bdf26a7-1530-4dd1-bfae-62875508a27c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4911ad2-fd83-4cab-b67f-dad6d06d784f", "sighting_of_ref": "indicator--5a645d57-7e99-4dd6-bb77-7b532785c9c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87c98159-6714-4fe9-a132-e13d2363d370", "sighting_of_ref": "indicator--f91ff412-d631-484f-b0e5-d1056ecfebae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba27e69b-9608-4dab-9a18-1f0f8a50feee", "sighting_of_ref": "indicator--e09dbcc4-ec11-4796-bec4-ebe5e91da21f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2eea5ba-4b2d-4dc4-8c2b-5b5cf0ee00fb", "sighting_of_ref": "indicator--896bbed4-aaee-49c7-bbb9-ec9aeabfd74e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abcc89cb-78da-4531-83da-36177314f9f6", "sighting_of_ref": "indicator--f4a08d01-c33d-4c16-a23d-b69196d1add8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b27e6c8f-981a-457b-9ebd-b87f47b3accd", "sighting_of_ref": "indicator--3dda23fa-aa56-44b3-a72f-1abf256f6042", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05bfe537-d071-4c3a-915c-71b4342f29d1", "sighting_of_ref": "indicator--376d626e-50ca-475f-89ec-1f746f0dd6a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42df9f16-a4fa-43c1-983a-a00e20ea2e29", "sighting_of_ref": "indicator--b5298173-3825-4d19-bf86-75d356a6a142", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95ed4d53-c51a-4ee4-bae2-f9240b5de18b", "sighting_of_ref": "indicator--240bd14b-4692-4e0b-a901-a6deebcaaa80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1554b5e-373b-43b5-82e2-4fd9676798d8", "sighting_of_ref": "indicator--f18ee197-b2ac-41ee-a5e6-d109046a0d0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d7c840c-e75c-4bab-b3d7-6302ae6bc6bc", "sighting_of_ref": "indicator--4485f69a-980b-4da4-8b66-160dfd4722fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb8b534-56dd-481c-9960-8cdff7d3ae41", "sighting_of_ref": "indicator--f9e290a0-acf4-4751-9298-3adc3c24a861", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--070cad50-a83c-42cc-b32f-d544bb466c5e", "sighting_of_ref": "indicator--0ce3ce04-6260-41b1-9ad1-a8cec47c8d6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c77c6223-3135-45da-b82e-d65fbe13d4c3", "sighting_of_ref": "indicator--a2276dd3-c804-4a8c-9ef1-5467e1a8bde1", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b1c0b4-7e3a-406c-88cc-162d2444fc0b", "sighting_of_ref": "indicator--6191845c-182d-4696-9d04-498915b9228a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defcf099-2df0-4c28-a10d-887c816c82f5", "sighting_of_ref": "indicator--a34cfba2-20b5-44bc-8623-0dc9f92a6fa7", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e1b074-b921-47ff-9a53-28c892123615", "sighting_of_ref": "indicator--a34cfba2-20b5-44bc-8623-0dc9f92a6fa7", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1653a4b7-0fd2-4084-9f95-18d2675c64cd", "sighting_of_ref": "indicator--0fe3a8f7-60d2-4f63-80c1-c3e98c62cf3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51403146-b0ee-467a-831b-5a4c291fe57f", "sighting_of_ref": "indicator--afb49d05-2310-4730-92a0-f45a8f610e7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a615aef-60c6-4072-b875-fbb197442e2f", "sighting_of_ref": "indicator--95c56f73-485c-4754-a6b9-589b97e18bae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d47c04c-0737-4aeb-9946-3c4ed4ffc11e", "sighting_of_ref": "indicator--9da2e558-2ec2-4512-8366-a41300accc0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da2c92a7-aa8f-4d84-863f-cb937972e7d6", "sighting_of_ref": "indicator--d16f4b12-a215-4445-9b6f-809908488502", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab9c2f1-69b5-4726-9b7a-b85a87a7deee", "sighting_of_ref": "indicator--94af07f9-d321-4a3f-9502-2865c8862d85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1841fc8f-16f3-42be-a9de-0362dd047874", "sighting_of_ref": "indicator--9946d2ea-6076-49ea-8836-d2787bbfc182", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1763cf04-355c-46a3-b25a-62f849a954ce", "sighting_of_ref": "indicator--926f0278-762b-499b-a696-3a8e6a5c89cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d89bdf-07de-42fa-bdfe-322088989261", "sighting_of_ref": "indicator--468fd63d-83a0-441f-a488-43da84d10aaf", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c34a6a-8d1b-4610-ad29-188055979536", "sighting_of_ref": "indicator--16924528-dddc-4615-be84-58540ef3d580", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f96c54-8770-4911-aea8-a9e38f28487d", "sighting_of_ref": "indicator--e9d3d819-6305-4383-9356-1f2c768404fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--721df250-cf8c-49d9-9f12-518b056d977d", "sighting_of_ref": "indicator--62a83afc-3309-4361-a531-90fe44f9d4d1", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b798e61-6f2d-4c85-96d3-37157b1745cc", "sighting_of_ref": "indicator--55d6c47d-b1cc-4737-aef2-979946c1d2a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309f9e6b-a772-4865-87a1-5bcc37432eb9", "sighting_of_ref": "indicator--9f4ed4de-c9e3-4785-a947-81a95adc260a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7205728f-ce9f-4937-a4f0-13931833a0c3", "sighting_of_ref": "indicator--10086d04-4096-464a-a3e6-707efa71671d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac9dd678-3a8c-4f71-896e-5b51c31bf25d", "sighting_of_ref": "indicator--35fea427-1e48-48c1-a74f-7b5e6e725789", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66bdc25-7504-4fbd-a04f-d64d9fdd0d9d", "sighting_of_ref": "indicator--440f483a-9222-4b1d-bf21-fc51b19cf7e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--105af46b-d56e-47d7-9bc6-d7a7e72f8f2c", "sighting_of_ref": "indicator--4842225f-3efc-4a38-a417-e8a17e7d95d8", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69796123-4b4e-4b94-91ab-f3dedc9c2dfa", "sighting_of_ref": "indicator--d36ed26d-61eb-403b-b2bc-ef3090a89942", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdd34064-fdaa-4aac-b715-8954dbd9f3e2", "sighting_of_ref": "indicator--ad498371-d1bb-49ed-8a81-f955df85f0bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ba42d7f-196a-43c2-ab86-154f14bb7079", "sighting_of_ref": "indicator--c2ceb2ee-be8b-4504-a7d0-0b92ddd3ebb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f1c9e9-9085-4a3a-a5fd-7be9e6ca1c39", "sighting_of_ref": "indicator--1a29d70e-b461-49c4-8c54-fc2e53b08605", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3c64e14-c629-45f2-bdde-18c493441b9d", "sighting_of_ref": "indicator--dababc19-18b8-41fd-9e49-415f52b2f6be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4534d945-bb63-4b73-a661-6dac27a5d135", "sighting_of_ref": "indicator--abfc4989-244e-4318-8629-8028275c34aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a96726e-0649-4687-8af9-9f3932480405", "sighting_of_ref": "indicator--6a91ebd1-1ce7-451d-9d41-cc517a0e340d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4394915-8e8d-4bde-a375-3b648af8b99a", "sighting_of_ref": "indicator--95b219ad-b8b4-4bbe-9997-2dd939817eaf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ed4eb9b-8de7-4ee1-a560-5cdc1f0bacae", "sighting_of_ref": "indicator--8b288526-8eb6-4313-8b80-f8699538e872", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3130eb3e-d82f-4370-a197-fdc1929e5dfb", "sighting_of_ref": "indicator--a9e9e14a-142e-4ec8-bf21-5e2d54aa0886", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78be5906-7479-495d-9f9d-559c83883471", "sighting_of_ref": "indicator--5750b2fa-f0a0-4454-8155-74513a2aaef9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e3bd604-81be-4627-9e90-c38821d7bcfd", "sighting_of_ref": "indicator--5fe8b779-a569-4100-a42b-5b97d1289e79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1851f21c-8ec3-4ead-ad14-774f61aa4f72", "sighting_of_ref": "indicator--19e31aed-a589-4217-8dca-fe7958db081a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66e3dbc5-bd47-47b2-a71a-79a830543276", "sighting_of_ref": "indicator--0398caf9-1156-4dad-a0dc-61cb36bbf0ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eac975e0-fe07-41bd-b3f8-2bad52676046", "sighting_of_ref": "indicator--25932184-0f17-4e70-ad89-899dc15a6bee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e614f990-223c-4695-a5ac-0517f1fe4781", "sighting_of_ref": "indicator--72bc7fd1-bbbb-42e8-9d4e-abed0704944a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99096695-d4c1-49d0-908a-8e011d660cdb", "sighting_of_ref": "indicator--01de7c97-bf4e-4b12-b2e7-71583a66eccd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57756aca-4868-4765-baa3-2477fa945343", "sighting_of_ref": "indicator--b37d51a2-01a3-41b5-a221-f1fcbd7d94d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7965096-e768-400c-9128-5b601ee1b6f4", "sighting_of_ref": "indicator--02937370-ef4a-4f93-9242-713d3e04fa39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86791eb7-7b84-469c-958a-258b415ed868", "sighting_of_ref": "indicator--01ab0d9a-ce04-4d2f-9682-c08632c84881", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fde90372-0862-4e96-9bff-e2d9168360b2", "sighting_of_ref": "indicator--429caafa-8a99-4b3e-8690-ae766e90355f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bbea6c7-3d0a-4683-8b1e-e57ee95ae64f", "sighting_of_ref": "indicator--dfe87352-e21c-44d9-bbdf-23a05d0a94cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32395bb3-9168-4a4e-ad2d-dd67d59a95eb", "sighting_of_ref": "indicator--ad7e43c4-51d0-41a3-abe2-fa8e68c05ce2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd256f5d-dcf3-4da8-a7b7-438592adfaf6", "sighting_of_ref": "indicator--42c5aa0d-d4ca-488f-820e-07b2d1ea13e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33951c9c-8b98-4105-8c87-fee4f26dbeea", "sighting_of_ref": "indicator--9abb2766-1333-4ab2-b04f-5d15a8ed7db2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--722c7a80-1e03-456d-8c4d-d78c297d618e", "sighting_of_ref": "indicator--de8e81ca-5f47-4ac0-9abf-50acfe88d6b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c451e5-a23a-4941-ad4f-5a8afa60945e", "sighting_of_ref": "indicator--82123b8a-76fb-4f39-b2d9-ceb8d578cfa7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22b91159-5cc0-4b02-aab6-f463221f34b3", "sighting_of_ref": "indicator--89753a70-9574-4692-a213-58656f980f0c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af1dce8f-1679-452b-a035-e6198c442b35", "sighting_of_ref": "indicator--575c21d9-6e3f-4dc0-b2c1-aa59e3dd9d70", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309d3c92-a778-4d60-a681-40eef6ed2af0", "sighting_of_ref": "indicator--84a4bf4e-25ce-4686-8921-09480df53398", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99cfda7d-ddfa-4c0d-8d42-26948f76bf75", "sighting_of_ref": "indicator--074b21b3-8056-438b-b149-2300a95cd8ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbfdbbec-d8de-4136-b955-ef178ffec66c", "sighting_of_ref": "indicator--03da707e-09ca-417f-99ca-a75b5668295f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21467e8c-07b5-4228-b7df-fe1697cc47e0", "sighting_of_ref": "indicator--9538fa51-8cc4-4853-848e-6ef2cb556840", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4838e017-56b2-46c4-8f0e-418b0eccbde8", "sighting_of_ref": "indicator--ddbdd1f2-6793-4e6e-92e7-6210805cfc86", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65f60ee9-d25c-49e3-9e1a-fe663e766ffb", "sighting_of_ref": "indicator--74ebe6ce-210d-4e56-b159-2d5f07b97c6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9094a37-56e5-4883-b7a7-5af0c4df3bc7", "sighting_of_ref": "indicator--6b0b1944-bb07-4b6e-af2f-845325ec7bb4", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf400c99-e0ef-4709-af0a-4079efda7aba", "sighting_of_ref": "indicator--6a633dfe-b291-4a66-9f78-3ef0a173b62e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9cab7ce-2565-4af8-a69d-37afee7c6fcb", "sighting_of_ref": "indicator--d4c3c2ef-13e1-43ff-aa32-45d49fb38cb5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d258e291-68bd-40a6-9e6a-89dd3cda3c54", "sighting_of_ref": "indicator--60eeabdd-3bbb-49b9-998c-d0a429e1f77a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b74321d-8b89-4e7a-a1fd-d81f4a49d2bc", "sighting_of_ref": "indicator--3215626f-db73-4056-ad70-117b573b919d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ce59822-8d44-4fd5-a401-2da614aa1a0d", "sighting_of_ref": "indicator--42812c33-df54-4ece-8a8c-9e3032b1477b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e65eeee-6948-481a-b12c-b61cdf4865c8", "sighting_of_ref": "indicator--a9c057e2-1dc8-42b9-876c-f3cac8a565ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374258c9-94fa-40e3-896a-1e79239acfe8", "sighting_of_ref": "indicator--634fd2be-b650-43f7-a554-430b023613ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13549cb-ae2b-4f0b-b076-a57fa96718f2", "sighting_of_ref": "indicator--22fda037-ba9c-4c30-a37b-79dec3501062", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdee906a-91ce-463e-9562-5b946886f3d7", "sighting_of_ref": "indicator--3c715ac9-870c-4132-8890-773c70ae5278", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22af5bd3-d257-4309-8356-c882a4356fd9", "sighting_of_ref": "indicator--de239ace-915f-409a-bff2-e187a2797887", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6069acd4-dada-4660-b498-e59c620ce8fc", "sighting_of_ref": "indicator--b3dfc9ed-d824-4dd9-a673-a3c5467d6944", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce658f0c-f8a0-4d51-aeaf-088bdffd58d7", "sighting_of_ref": "indicator--db730885-e535-4ec3-99e3-dbdb82a8b2f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4971c91d-ccfb-4547-b2e8-63008fcdf08e", "sighting_of_ref": "indicator--a6eadc70-9883-426e-9328-59a7a964e70d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e733b521-20f8-424f-a60c-23c7ef9e7dcf", "sighting_of_ref": "indicator--c85e7675-c473-4190-9408-9ae1a382f58f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfc388b3-1ea2-4b52-8894-61909691ae7c", "sighting_of_ref": "indicator--81beef3a-57e8-48a2-931a-f349089b7c43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55823c07-b7a7-4dbf-bec5-453fb920cc02", "sighting_of_ref": "indicator--ff59b6ff-7fbe-451e-ae3f-bb0790aabbbe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0046dd46-955e-441e-8ccb-3885ddf1e303", "sighting_of_ref": "indicator--e53eaa6e-491e-4f61-8e73-9ad1a5d9520a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69814eb2-33a3-451c-ba1a-fb715c837eb5", "sighting_of_ref": "indicator--d4a9e69b-182d-48ea-a4a8-f45db20e863d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1851db39-fa7d-4875-890b-329d5d79a2c1", "sighting_of_ref": "indicator--f432a9d3-17aa-4e30-b6a2-23c9f395ba85", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7258a7a-bef3-42b9-adeb-0b8765b4895b", "sighting_of_ref": "indicator--d6ed2898-f761-43b3-80a9-3437819b3684", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18893762-cb73-43b0-a1c1-6e2ceb5b38b8", "sighting_of_ref": "indicator--6db1e3c6-00a6-454e-b66c-e4c365ac26c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aee7c484-2446-44bf-98e2-d3c59fc1c512", "sighting_of_ref": "indicator--40b36693-b290-411d-a46d-e661086bfb17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e79341-76a3-48a5-abe6-6e3b618bebe2", "sighting_of_ref": "indicator--61fb3e33-afa8-42d0-8423-77e2a902a621", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f49930bf-3c6a-46ec-b694-60b06ba183f1", "sighting_of_ref": "indicator--0a9df23e-f683-480d-b616-c7e768af6ad6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aa16502-f73d-4ab0-895d-929456ce2a1c", "sighting_of_ref": "indicator--88f688c7-dc2b-48f2-8438-3001c925d316", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09ab53e2-16c4-42a4-8a29-7e1242951209", "sighting_of_ref": "indicator--57db903c-6abf-4295-a2d4-55a1b52b14ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7602956-8487-45ba-a929-1d79d956f776", "sighting_of_ref": "indicator--b4d12d2c-9e61-49c1-b3c1-28a117c006d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1a1f9db-4ccc-472f-aad9-95dcfb45f3d9", "sighting_of_ref": "indicator--dede613d-96fd-4c6f-903e-d1e4bb01a331", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--963a2948-92de-40c3-97e4-efc1ea4e785e", "sighting_of_ref": "indicator--315ea5ed-ac31-497c-a85f-4a1aae5be8fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c6dcde-1eb7-46cb-8027-7bdf6d762445", "sighting_of_ref": "indicator--b0fca92b-9483-4c20-b4ff-932115c38593", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e829054e-0574-4083-bcb5-bd053a6b0936", "sighting_of_ref": "indicator--5d7a8854-3236-44b2-bf78-63710e583ad8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e2d16d-df9b-477f-b97a-effcd7c8f450", "sighting_of_ref": "indicator--3cb690f9-f3b3-4a5f-8f7f-c7a5c366f49c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34b1980-fff1-4d32-b5eb-4d9a5b9192f8", "sighting_of_ref": "indicator--f99dcee8-64a4-470d-b171-909129b9f411", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217992e0-0b7b-49fb-b072-7092bac2b227", "sighting_of_ref": "indicator--0d9656f1-0233-4378-a926-ced94b722754", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ea692a8-40e7-48d7-ae50-302d52a69067", "sighting_of_ref": "indicator--6237d1bf-b597-4bee-8ac0-708c62bf4313", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01a2a93c-92ee-4aa6-9638-6f6c826e56d6", "sighting_of_ref": "indicator--6a406135-0e9b-42dc-afc7-51ed3c78cfce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b96f6cf4-bdf0-46f7-b51d-2666bfa3b9fa", "sighting_of_ref": "indicator--08fe6522-262e-4333-911e-6a9fc1c17be5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9789e41-6ed6-4305-8a95-9d8b36b1ecfd", "sighting_of_ref": "indicator--8785cb4f-62e0-43b9-8101-e5d7bfd11f94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1edcbcc0-86c2-4a3d-a39f-3af0a2adb85f", "sighting_of_ref": "indicator--48f1a093-6cd8-41c3-92ca-f95b191a8351", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--862301eb-19c3-41e8-bda6-00a4dc2c1262", "sighting_of_ref": "indicator--412aa352-2893-4454-8b7e-4de3756ee933", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94eb262e-53dd-480c-be78-fc326b789e7c", "sighting_of_ref": "indicator--d1ff7945-b34c-4595-9f97-64393527e35f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd5b4ad3-36a1-44a9-9c04-c431a8ce6db6", "sighting_of_ref": "indicator--9fe830d6-641b-4d7d-a195-079cb8373324", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a9d1cc-05a4-4362-802f-5016526e9ede", "sighting_of_ref": "indicator--c9ae688f-ec3a-4674-a03a-b3ff4c30bb4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ce1fc74-e48b-4717-88b6-3e0f517c7f1c", "sighting_of_ref": "indicator--4acaadc5-46ef-4072-8da2-e38af364321d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460cdc6e-8cf0-4d82-832b-5ca9e11cfcb6", "sighting_of_ref": "indicator--60801923-e9dc-44cb-96ea-7f3ca7a04f48", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b343c14a-0244-43d7-b4bb-7a0906141dd5", "sighting_of_ref": "indicator--3c5f1f5d-9429-4c33-ae93-5ca94eec264f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1033a7ac-fce8-41a0-8ee0-04c15964ed1d", "sighting_of_ref": "indicator--fff9443e-b4c0-4cd8-8297-b13ac9f330b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc75cb82-8ef4-431c-8254-ed3ab8bf19ac", "sighting_of_ref": "indicator--a2d93df0-1024-4797-b4d8-ff13567a8358", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d35b6f6-f856-42ed-921f-781e60dcea09", "sighting_of_ref": "indicator--0c303c2d-b9a8-48ee-8671-6592f04c28f5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754a0334-c16a-4aaa-8b42-3aa31913c5d8", "sighting_of_ref": "indicator--2c21ec9b-3fc0-454b-b5c6-191f77034f6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5793c0ec-aabb-4360-ab3b-6c3b78fe3ffb", "sighting_of_ref": "indicator--e455162e-a906-425d-b323-5b94667060af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90189e93-06d8-46ef-a934-415878f32b1b", "sighting_of_ref": "indicator--80e74be5-ee28-4345-8ad3-10653bcd42d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36fa0988-e7ba-4c02-91f7-6ee957f77871", "sighting_of_ref": "indicator--f340a7dc-a39f-4e8b-90cb-bd11b5a99114", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f912bd96-3965-41e3-be34-d6a4032516ee", "sighting_of_ref": "indicator--32ddf223-0c24-43e6-9dc9-820a928514a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa14f6f7-6af3-4ea7-82ad-395e2102c113", "sighting_of_ref": "indicator--4e5f65fe-4ca0-4f81-b545-f84205188756", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05168031-e82c-433a-b2c0-f0e9b50762ba", "sighting_of_ref": "indicator--c125ff89-a85c-45ba-9ccf-919224fb6b0f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52307121-83ae-49ee-b429-ff8ad172544d", "sighting_of_ref": "indicator--fc1a750b-9329-4ff9-a966-00e4769aaea8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4654d40-ca68-429f-80d9-fa761c227be8", "sighting_of_ref": "indicator--3e513544-5230-4e7c-be26-e6b17c21d2d1", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--042399dd-7826-4e11-aa7f-e10e6e92ca38", "sighting_of_ref": "indicator--484aed03-a69a-4d64-9c22-eb55739e9392", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--086b0481-d103-4de1-8c84-a8c2e3a9811f", "sighting_of_ref": "indicator--484aed03-a69a-4d64-9c22-eb55739e9392", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b4e0381-e23e-4107-8b8b-d79c300c8199", "sighting_of_ref": "indicator--e0382ff3-1729-413a-81c5-4ebb53eaac6e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a03cdb7-6ddd-4eac-a0da-0736a54794dd", "sighting_of_ref": "indicator--5597f5bd-2907-4df6-8ded-98df54853230", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1770c3a-707e-48b1-bc2e-0eb4f5748896", "sighting_of_ref": "indicator--39be47a6-0062-4b5e-99a7-87b3d2eb16d0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdcece9e-2fe4-4b66-a0e3-29c4704dd3ae", "sighting_of_ref": "indicator--f014b127-614e-4014-ab59-5ed101809a3e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff94fa45-1150-4a25-a6e4-1f95745b8781", "sighting_of_ref": "indicator--f4681b81-76dc-4453-b78c-3808e676526a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7502f87-7dbd-470a-82e8-a0ec8e255b53", "sighting_of_ref": "indicator--365db797-9e05-47e2-9dee-ed88768dbb66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4638a60-9d94-41f1-8311-60ac3650969c", "sighting_of_ref": "indicator--7c9e03a9-43a2-4fee-bc7d-4650067c8b41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d508429e-c91c-4f28-a724-9ed439b878bd", "sighting_of_ref": "indicator--4cc19772-4fbf-4b37-ad80-e52f80142e61", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ddc22a-b25e-46e6-b53c-86cffb9852f0", "sighting_of_ref": "indicator--15780ac0-e723-43d5-8cb2-cfa19655ec77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e3c01c4-f784-4fe0-9b18-ab50cc404088", "sighting_of_ref": "indicator--ff4846e9-67b9-4109-b026-2f54e373ea81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e2d5caf-17af-45a6-a3d6-07aafd07f4aa", "sighting_of_ref": "indicator--8b621b0e-059a-4475-b8b7-b4a16f30ee0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a597872-632b-4c2d-ac05-23943092838f", "sighting_of_ref": "indicator--f068bf07-de09-4433-a83e-ac9aaa16a5d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0303b887-9193-4e43-a98d-dcd7bfb5ac38", "sighting_of_ref": "indicator--835a3db8-1895-4af6-916e-40688997b2eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd9ef34-2dac-4118-9589-6f7262c691d2", "sighting_of_ref": "indicator--de288124-addf-4c4b-bba1-afd217d97dc2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9044c757-d614-4f60-8b55-6b6341cdeece", "sighting_of_ref": "indicator--36aad525-3dea-4ee4-bcc7-8e088f7c0fb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5516a692-ca8d-4781-8874-58ea02e5b04f", "sighting_of_ref": "indicator--10ec975a-0c9a-4e34-b123-9bebe368e406", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89b1530-9232-4681-9f53-0f53f6cdb44b", "sighting_of_ref": "indicator--1ee54329-06cb-4812-af10-5758f16db121", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d4466c1-2c91-4ea7-b14e-774eb68872aa", "sighting_of_ref": "indicator--76eb4814-df36-449e-aff8-a67eb09cce62", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f4a8377-e966-4be4-a13a-5549f6a0f5cf", "sighting_of_ref": "indicator--ecec5b7d-7b04-4da0-a29b-9b75e244d409", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3665406-a775-48d1-b4e2-a5eb3302598a", "sighting_of_ref": "indicator--6d815abc-b26c-4924-a10f-70eeb32d8e37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c28ee0-82b5-46af-868d-be99d5e74014", "sighting_of_ref": "indicator--6c85ceea-15a1-4eb2-888c-746ae15c9123", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bd54046-f587-46bd-a1ea-599b9d3ae0c1", "sighting_of_ref": "indicator--a1949c8e-f201-4fe1-9c80-2e19e0aae78e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309f53c7-573a-40aa-9db3-fdd0193f2c92", "sighting_of_ref": "indicator--91aad7f3-427e-48d2-98dc-8f1301477cbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c7098b2-ebad-4a1b-a7e8-8ac64ad0506b", "sighting_of_ref": "indicator--6b5f638d-6750-4b7f-a478-96ac5bab8265", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81640c6-b54d-4334-93d3-4447b75bf995", "sighting_of_ref": "indicator--d620eedf-8a50-4538-9d82-dc2ccc1563cb", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f62f33e-c8c1-4366-888f-97dca2c66793", "sighting_of_ref": "indicator--f3b63ab0-1f33-4646-a665-4f3e3aebf351", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb034014-496a-459f-922b-96a977443528", "sighting_of_ref": "indicator--47e250c5-759f-465a-aaec-b28487ac388d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87fd0d7-49fa-428a-86e5-9c2090b07287", "sighting_of_ref": "indicator--81429af0-6309-4850-a0d2-d544f4cf5f75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a573be-d44c-4856-ae9f-b71dff479d50", "sighting_of_ref": "indicator--09d6814c-bc38-4b43-ade2-ade61e2efc61", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11f150da-d81b-42c6-9069-d0be1a5e6844", "sighting_of_ref": "indicator--cc61b2c3-5e56-4d79-9f60-943dabb29243", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed830ff6-378a-43fa-b2a5-6f694d9e9c44", "sighting_of_ref": "indicator--437aa213-ee3f-43a4-8c0c-af5ec8d2f761", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82de7e7-5559-4155-99f9-c313e0c7523e", "sighting_of_ref": "indicator--c366aa39-2162-41c3-b73f-2799ded339bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e09138f5-68f5-4e72-8c7b-b76b70431d44", "sighting_of_ref": "indicator--59b7fa0a-5034-4d0f-b7ff-a0cde627629d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--067d0301-908e-42dc-84f3-c290a0bbd9bd", "sighting_of_ref": "indicator--28018ab4-a1eb-4684-b4e6-a1d857d03bb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73ddeb09-73c4-4221-8e02-caea9da60e47", "sighting_of_ref": "indicator--9381e3f8-a80c-4a4f-aec1-06732d363ce0", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5127405-a774-44d7-84b7-3e9c359a092d", "sighting_of_ref": "indicator--fa6a5830-c226-49d5-bf9f-9b5c0271d402", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ea4ed6-88db-4319-8fd6-d068b2110fb4", "sighting_of_ref": "indicator--eaf79d0d-0a2b-41d7-8970-1465a96dbc53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3130d640-2c0a-4b73-bff4-e43a69bc27bd", "sighting_of_ref": "indicator--25520c30-7dd2-468c-ad8d-baaa5f141ec1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b59ffa2a-7f4f-4088-822c-e089abaef560", "sighting_of_ref": "indicator--7cc90a97-afac-4aff-ab6d-86837c82b180", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c7d0e2e-cfaf-4f59-aa6a-cdba0703ea3a", "sighting_of_ref": "indicator--e9f47e44-483c-4e36-92db-105edd196e82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a976ad3c-f5a0-4580-a601-defd2b33d6c1", "sighting_of_ref": "indicator--e79ef9bd-c577-4b6a-a052-5b01bc49b64f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--193f18c9-e241-4626-a285-ce58b1149447", "sighting_of_ref": "indicator--1edee59f-3bc0-470d-9996-1688557d2c18", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664868db-b28c-43ad-941f-f126f73bdbd4", "sighting_of_ref": "indicator--9335add7-d7bb-4988-bc9a-0cff4262c376", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c6ad802-97fb-4848-8f58-ed0f2d451e9d", "sighting_of_ref": "indicator--5a910959-8a4d-473d-a299-89b2b747277f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa7f3d7d-2e54-43ae-a895-e3e41fdf8e0d", "sighting_of_ref": "indicator--df4f9fe5-8a94-4d81-8594-920718b27a13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e6297c2-e2af-4d09-be32-b0a2912f1e57", "sighting_of_ref": "indicator--2baafcb2-e7e5-41a0-817e-cf8f72af9257", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a0c1e79-55c4-493d-92a6-3420e42a30d5", "sighting_of_ref": "indicator--973b759a-9ec8-4697-ac5e-b48c155ce97e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b926329c-a420-4db2-9ba3-9b554894d362", "sighting_of_ref": "indicator--53007b35-bca4-4499-bcc2-70177341070f", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c81f3494-1d91-4251-bc2e-13bd3ca877f7", "sighting_of_ref": "indicator--53007b35-bca4-4499-bcc2-70177341070f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e4f7ada-1842-4f4c-b7b4-4f8ced3e6407", "sighting_of_ref": "indicator--64c6ccd6-b8b6-428c-9cf8-5cd14c44b39a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36aa45b-b117-4179-abba-6d926f352533", "sighting_of_ref": "indicator--bfa57a61-2de6-450b-b8d6-31cb8670a634", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--004fbebf-278b-4445-ac8c-d39b6e0effd8", "sighting_of_ref": "indicator--6acea98e-f7f5-4870-9ff6-a704169bc317", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0474ca-bd19-43ec-9cfa-4a7294d16b5f", "sighting_of_ref": "indicator--07f06fa2-9b9a-46c3-b09e-8c987bc7cd01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6ea38ca-a7fc-4ecf-9b1e-3407ebbdae37", "sighting_of_ref": "indicator--f10642f8-8bd2-467d-84e0-74f9ec742bd8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d93038-c235-4191-9136-5e5b54a933c6", "sighting_of_ref": "indicator--4c3bd783-fa2c-4e31-977a-ff9a662b5fe1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--354a2184-ab2d-46a2-889c-7ed5308a5ba3", "sighting_of_ref": "indicator--2b7e3c51-52c4-42b6-9c53-a3305b3586ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a8f0c21-23c0-4eb9-bc6f-c5c3174a7cc3", "sighting_of_ref": "indicator--e22ef891-b3a4-462e-a3c1-7d7fbdd36792", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337c21ce-170f-4332-a204-251f539268c0", "sighting_of_ref": "indicator--d24ade4e-fc3e-4ce4-93a6-6a72b463ff0c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23063d3c-a18d-46c1-bb80-82ea7e8ebd63", "sighting_of_ref": "indicator--b689ce2c-472c-4bbc-92b8-fa7e355007f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aba60ac3-05b1-4fd5-b79c-22eca22b309f", "sighting_of_ref": "indicator--7a0e8e5d-6499-4dcd-a114-6ea463cd3b5e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f65947ac-4f41-4e4a-b192-56a7e58b7eac", "sighting_of_ref": "indicator--17854d16-1f52-4a3d-b5aa-7f06986d50d4", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33313e2b-26d5-4c82-92f9-7f96ba2ffb0d", "sighting_of_ref": "indicator--acdc30d2-1d09-479e-995d-0e5bd91a28a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c36720-53e6-496d-a8fc-2baf8fbf8e11", "sighting_of_ref": "indicator--7b0888c0-bff8-4933-958e-7e8842e77e14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b686e0c8-ce8c-4f54-99e0-47e36446ca45", "sighting_of_ref": "indicator--2ad8efff-0a38-4aa2-aa03-2b82e6b83aa3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--479a781c-524e-49f8-b429-79d5a4af9c22", "sighting_of_ref": "indicator--abfa0a38-ada8-4614-a3d1-dd6316196226", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5057a5f-4e9f-4483-8a64-76d637b0fbcc", "sighting_of_ref": "indicator--07040054-528b-4143-bf54-fecffac8a1ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34fe1817-5f67-4f1a-a261-18924cb494e7", "sighting_of_ref": "indicator--ee4c68e5-7ef2-4d8e-9a1c-a0e0207b5cba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3211e1f-adfc-489f-99d1-9e0f6199aa14", "sighting_of_ref": "indicator--293e219a-feab-4e61-afae-44fc2ae8e9b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92cae7ce-e68a-4eaa-900c-8bea108a41df", "sighting_of_ref": "indicator--7a8fee0f-7b06-4ea2-acbd-64f9c3f4c0b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6be29370-08a9-43ca-a9dc-3f9b16be4090", "sighting_of_ref": "indicator--c9cd4f5b-c3c0-4cf3-a2f8-d800dc227096", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de2aca0-f2d2-4050-8a25-0b68637bfa4f", "sighting_of_ref": "indicator--9610474b-10e2-49ff-83d6-c9683e8fd5c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08393877-c9d9-4284-909d-bdca7d52df05", "sighting_of_ref": "indicator--ab9e6c72-6601-415b-8133-8df85809d604", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e147fbf-54f6-4788-9aec-f7ba10eb14bc", "sighting_of_ref": "indicator--8d3458a0-6977-4236-bf46-e94e1edc5a02", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1058fc5c-e3dd-41ba-8b44-2abe05b27b67", "sighting_of_ref": "indicator--8689e719-bbbc-4f3e-83bd-145f32ec8c4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2db3c509-b0f4-4bca-9232-5dde9a15e2b8", "sighting_of_ref": "indicator--667481b7-9314-41c9-9878-4b2da97ab47f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9260fc-f6b3-416d-8c32-d7371271ebb6", "sighting_of_ref": "indicator--4e33760e-7503-42e7-8ada-6437383bf558", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0971111b-90f6-433d-b3e9-b66a7d7cf074", "sighting_of_ref": "indicator--e6af8efd-43d6-4b24-973c-cc863b8c7478", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5aa40a8-1d9d-4000-b70c-cc064e25e682", "sighting_of_ref": "indicator--0b261e19-b5b5-472d-abb3-b4492dbfd628", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0694912-2bcd-4096-82fe-e426f189c4c1", "sighting_of_ref": "indicator--757b8d2c-4b3f-4cee-b2d6-2d9a98af8eff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fcad79b-87e7-4813-b2fc-ca2c5c856ced", "sighting_of_ref": "indicator--b9a55a69-10ef-43b6-8382-915821b8ea82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc5c6c3-7f2f-4bd6-8e8b-78de3323368c", "sighting_of_ref": "indicator--ecf6395d-d176-4e5b-8555-ec8b0e0b46ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dfe50e2-3717-46e2-898d-060a4acb7cf1", "sighting_of_ref": "indicator--97714922-7a97-425f-90cf-c6ca3b78b4da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf314354-2fa9-4ada-bb84-5b3844807e24", "sighting_of_ref": "indicator--c37237c6-c48c-4405-ab98-70ac3a8242ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32cb677c-2607-412e-a5b3-17fe25a396af", "sighting_of_ref": "indicator--a4973cc7-7610-45d5-8448-c9bd0fae150c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac88837c-a275-4232-9539-d8d71ec9a717", "sighting_of_ref": "indicator--279aa1ca-b4cc-472f-a710-e2e6956e4c25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed88ea8-2190-4ed8-a7ad-3e958c0f2fcb", "sighting_of_ref": "indicator--29f15e2d-bfd8-4f35-bdd9-7f8c3060ab04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966ab913-8897-4adb-8a44-11839abe0a58", "sighting_of_ref": "indicator--d037620b-d0fa-453b-b581-4e94ecc8e6fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e7a93ad-70b2-492e-8051-58371d01e65e", "sighting_of_ref": "indicator--73bda2bb-7c83-48d8-8021-872631a6a348", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a52b7d9-be49-45af-a217-9cccd73a75ab", "sighting_of_ref": "indicator--49e58a23-db7d-472f-b778-6296383809c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e19af980-d18e-466b-8bb0-b475ea37925f", "sighting_of_ref": "indicator--b3d3fb06-45ce-438b-91b4-d963399bb71f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8177f97-8202-49e5-9e2b-225f09868f7f", "sighting_of_ref": "indicator--95107081-ded9-43f0-bcbc-8baf57ae4614", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d7f5fd0-b298-4292-88f9-e7145a1f6873", "sighting_of_ref": "indicator--3e72ddd1-8b2b-43cc-a10f-855d52749de9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37e1bae6-f1ea-43a6-bfea-5880066f3e12", "sighting_of_ref": "indicator--a245cfb2-a6b1-404f-9ea3-3b362a930963", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfe72fb5-86c8-472c-830b-71a096bf5c6d", "sighting_of_ref": "indicator--434948f7-5a22-4a62-9358-51ede5800c38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a88b032d-6dfe-41c1-91ea-d24073035004", "sighting_of_ref": "indicator--26ad723a-cbac-41df-84aa-6c4c62eb80f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b247851e-0194-485d-b998-4437d3d77df3", "sighting_of_ref": "indicator--74a15333-6cf5-4743-a307-99cb8ba305ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2c8f45-7add-4c9d-82c6-a72d40455af1", "sighting_of_ref": "indicator--a7be8fec-1eae-403a-aed8-577b1270b9b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b176feee-d740-4230-9570-cac1dc7025a9", "sighting_of_ref": "indicator--cd7c78b5-cbb3-4ed7-ae0f-d689ed69642b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2139cfe4-4895-4f2a-8ee1-be03903ca46e", "sighting_of_ref": "indicator--52767911-aee0-46b1-8fb8-b11740993cf9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14e87f83-5c4a-4d5e-9894-db3cc859f2c1", "sighting_of_ref": "indicator--49eb90d2-4735-4a76-bb58-68104da47d6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7472a6d4-69ab-495f-8944-e11d48426446", "sighting_of_ref": "indicator--9176f82f-8f70-4df5-8a82-9c3b977394a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b615ca-18b0-43fe-9b34-1e8ada53491c", "sighting_of_ref": "indicator--b6acdee5-1b71-42fe-889e-3db99a68fe67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--483a6a8e-cb8b-468c-a762-ff3feead011b", "sighting_of_ref": "indicator--69f4a9ed-1835-4a67-bc90-1cea89f3b9a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f70eed-01bb-495c-973b-81084eabc67d", "sighting_of_ref": "indicator--e270e048-0d1b-4697-9981-2efb63f85504", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32f988f1-81e2-497d-9590-cb383efeff3a", "sighting_of_ref": "indicator--ceefce0e-9f34-4a81-8f25-9e1b62326753", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7346b100-5697-4695-9b9b-5f80806407a3", "sighting_of_ref": "indicator--e672fe83-64a1-4b1d-8dce-0109cc3a3d23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcbb0fcb-199c-4a86-aec1-7bb927588128", "sighting_of_ref": "indicator--60600d8f-d08d-4087-9898-8d1d17a8539b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cb121c-433a-4a07-914d-abc5e747f142", "sighting_of_ref": "indicator--01a2574d-de78-4f85-897f-d4e7e7707e0f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e84fc3-e0b4-488a-a83b-3fce00d0a639", "sighting_of_ref": "indicator--6c2fe0aa-4492-4cf7-be0b-aab0e0ac41d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e8c89e-b96c-4c2d-b1d5-ad87aa86845e", "sighting_of_ref": "indicator--199d5887-070f-4a74-9e5d-b25e7adad742", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5ce9808-7b9f-4ace-89a9-466448e3fce0", "sighting_of_ref": "indicator--92ba1db0-0c90-4f31-8507-f0b7b7e54430", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdee768f-5ebe-4523-b380-33ee49b1cea3", "sighting_of_ref": "indicator--345e96fd-566c-4c17-b415-3a8038e6e69f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b30ed5b5-71d6-4a45-a84e-081ce4bdd2cf", "sighting_of_ref": "indicator--e315fd85-55fe-44e2-a7e3-799fad2dcff1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f66d77-86eb-48dd-bd91-79a8b962bc7f", "sighting_of_ref": "indicator--7cc69140-0ce6-432f-b904-f36cd2a1951d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c9fbe16-f28c-4473-9660-13f544386cfc", "sighting_of_ref": "indicator--a66fa1e7-29f9-4973-901a-0fdc0380ce3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee6b1b87-4ad5-4820-8435-405430cb9412", "sighting_of_ref": "indicator--a9d64573-e8aa-46fc-82e2-3a45129981b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17fc8cac-4a9e-4e54-9d9a-17c454ee03f9", "sighting_of_ref": "indicator--522bce82-39b8-43d7-ac68-1c89ee98d5f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e15534b-9bd9-489d-88e8-f88f68c17066", "sighting_of_ref": "indicator--244f0ee2-723e-4116-a37d-9ad8f1b9c12e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86aac348-db7c-4aba-847d-79f87f5d0ee6", "sighting_of_ref": "indicator--0b0ac3ae-4f84-4c88-9b91-7665abded309", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--267bd7c6-3b80-40b9-bb49-f95b8e8da090", "sighting_of_ref": "indicator--7a645957-7b17-4533-acb5-88b5fdf46ae9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d38db3e-e0ca-4db1-b53a-222680f8fa55", "sighting_of_ref": "indicator--16aaec90-d677-4f7e-b44c-2ebeb770ea9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e79b34-6867-429f-995c-06011cbeb3ac", "sighting_of_ref": "indicator--46f05ffd-f3c0-49d1-a153-99c76318750d", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--027963ed-1070-4cc6-97e2-556c2fad4ed4", "sighting_of_ref": "indicator--fcb547bb-ea46-4289-8162-36861ce07714", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b23c3b47-7870-4533-ba7e-1c5899446904", "sighting_of_ref": "indicator--35cbaa3d-69d1-471c-83de-51f6db574d0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2511ebf0-9c01-463e-993e-c36354abf678", "sighting_of_ref": "indicator--db706fa9-a6e9-4f46-bf4e-a480eafae405", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92139837-7012-43bb-bb4d-e59065f4de37", "sighting_of_ref": "indicator--715a91ad-665d-4769-a068-63c685c052e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f40bdf03-5e3e-4db7-8a00-9eefe20b7e24", "sighting_of_ref": "indicator--f6858f13-47aa-48f6-814a-94fc3198314d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08c9f419-9dda-4c20-b05b-377a9eb0a06b", "sighting_of_ref": "indicator--6a53165e-ecff-47d2-bc05-5291606bddb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--724637fd-0d5e-48b5-bbae-d681876f0b39", "sighting_of_ref": "indicator--38ae521f-283b-4036-b703-9c320d32f3bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bbd00fd-d892-41e2-b844-b02144e61765", "sighting_of_ref": "indicator--946f989b-fdf9-4deb-addd-7755546da9f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46af5012-fd84-4bbf-8ca3-355406c170dd", "sighting_of_ref": "indicator--cd064515-e899-4b83-9b84-318fe78a8a49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3598d0d-dcd3-4bdd-9861-1ab53f2affdb", "sighting_of_ref": "indicator--94abd5b8-2a69-406f-9a1f-9edca681ad70", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0993391-4493-436c-bba3-85a743255fc4", "sighting_of_ref": "indicator--2919e362-f3ed-43a2-ad1f-a107e2dc7e65", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--489db288-1806-4c87-8513-2467b29ab663", "sighting_of_ref": "indicator--ca004e72-91f0-4129-8321-3b5369fc8366", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba481208-5f45-4c85-bba3-84c9b4e8fca7", "sighting_of_ref": "indicator--a5290f07-4bad-407a-838a-d73338748612", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2ee7faf-051d-4e67-8f3e-ca390ec132f3", "sighting_of_ref": "indicator--58f1bf89-349b-4d7f-a726-a2d3eecb5af8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e02a5bc-ff56-411c-83a9-35146b215421", "sighting_of_ref": "indicator--59e766ad-4d17-45f6-99dd-5b93082a3c6e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc2eaa6e-03eb-451b-b915-bd08674487a2", "sighting_of_ref": "indicator--ee754175-9238-42c3-b968-77aab64eff9a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b344d2-cc0a-478e-9a27-421a1859f872", "sighting_of_ref": "indicator--9127a256-632f-4524-9169-db97c50e4872", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7886346f-8bf6-45ab-819c-848207ba3796", "sighting_of_ref": "indicator--9127a256-632f-4524-9169-db97c50e4872", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81c4adc6-0c57-48ad-baaa-377c77f67a85", "sighting_of_ref": "indicator--9127a256-632f-4524-9169-db97c50e4872", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abad05bd-08e6-47b1-9039-8e2982dc7801", "sighting_of_ref": "indicator--e170e748-dba3-46e5-86fd-93caf77b5f48", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c68445-c042-40a9-91c5-d8ebbb899a5c", "sighting_of_ref": "indicator--f72b9e33-c5f0-44ec-882c-0facccff60ca", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5abab1-23fd-4062-98d8-9ed626fbe44f", "sighting_of_ref": "indicator--4f4cf553-2e3e-45df-82a8-9ab1169f36af", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43c76931-0484-466d-bd76-f08cfa3e0759", "sighting_of_ref": "indicator--e7221a24-69d3-4c54-a0c5-a5ee7a9756c3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc1259b0-1500-4b02-b3c0-c6192ac2cc31", "sighting_of_ref": "indicator--586ad61e-90f1-4bcc-b786-05340f04b9e2", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f4fa9f-f412-4ce6-af86-6d1043a7f1f7", "sighting_of_ref": "indicator--b8b57d37-bef6-429a-8f97-392f744fc73c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c81c80-0a4d-4a96-936c-91d43cd0711e", "sighting_of_ref": "indicator--4df0eea8-5381-4920-a7b4-3b9e0dc9a5a1", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778a9e25-83d9-4393-9e18-2e43aba9dbd6", "sighting_of_ref": "indicator--975f3280-f3e2-42b3-8330-8171d462dcba", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--557aceb5-1eea-425e-84be-4be74a57cbbe", "sighting_of_ref": "indicator--816501ae-ac44-47a3-8fed-83f50990ff75", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c17a7bd3-0180-4713-917e-3ddfdb5295af", "sighting_of_ref": "indicator--6699c217-6c63-43dc-aa3a-2bc8444cbb61", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63e885ef-b392-4517-8c8b-61a5ba5fcebe", "sighting_of_ref": "indicator--82da4d97-eb1c-4081-8061-73f0b3d50523", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4613c498-9ee9-4d62-9844-dd3998fe1988", "sighting_of_ref": "indicator--d44badbe-ed6d-4abd-835c-686ba089d19a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--812e8b84-2110-4181-91b0-4abcecf8356d", "sighting_of_ref": "indicator--14b4de79-afe2-48b0-abc0-2c74cea886e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5db9b7a4-c2e5-4ca0-bc04-b63420de94a5", "sighting_of_ref": "indicator--98466405-3c4e-44ae-8aad-dbb83d46fcee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ea9860e-e7c1-4dfb-a5f2-34b3d8ae53ae", "sighting_of_ref": "indicator--cf136638-32a1-44a3-a732-844f909cc3b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667aafae-abdd-49e8-a5d5-1f9bda5a8a2e", "sighting_of_ref": "indicator--6ab006e0-13a4-4558-9904-7e2f466e009c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5970aee1-d7f4-4aea-9971-a309bb0fa84e", "sighting_of_ref": "indicator--ec29e4a9-b742-4187-8523-e6ff9d585130", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff11f05d-d190-4816-8080-712e1e7e2669", "sighting_of_ref": "indicator--ff543ba8-35b4-4ec1-ba04-29ff6d829da0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cf5a389-77bb-486e-a415-9bda92099a83", "sighting_of_ref": "indicator--06967d1f-e78a-4334-b71d-25f617419d62", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3f8f75f-1520-4874-9391-0b809d197bbb", "sighting_of_ref": "indicator--46743dd2-fe08-42fe-8eb3-d7530b6894f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--115af88b-fccd-4a01-bfd1-777bc39217c8", "sighting_of_ref": "indicator--76366620-7954-4600-9f69-c281352264fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c13126fd-7ac8-429b-97ff-ba3351765d68", "sighting_of_ref": "indicator--a2cec5b2-fe87-488c-a1b3-9a4508e246f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64697da-b6d8-416e-863f-1b4156bcf977", "sighting_of_ref": "indicator--f1cfadea-3342-46fd-aba9-be79e48c90fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--426d4887-b390-4a2e-832c-0bcbd9ca09bd", "sighting_of_ref": "indicator--adb3f678-08d9-45b0-861e-621c11f4b794", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df5237c6-73f1-4418-ad96-e7489644d823", "sighting_of_ref": "indicator--010da0e3-d48b-4cd1-9838-b6e24f3424a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78eef616-7cbc-4818-aca5-0aafba4263c8", "sighting_of_ref": "indicator--68e7c814-d6be-4a27-9f87-08699ae70775", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd09b86a-78cf-401f-b46a-5005ee7a3dc7", "sighting_of_ref": "indicator--4ae48a10-9270-4601-97dd-6371fca1851d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5502aab-0872-4b37-b0ed-3fecefe2c2f4", "sighting_of_ref": "indicator--014d8350-e963-4d77-b040-61f0b5896819", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1410c90-d13e-49ee-a307-caa72ddb9940", "sighting_of_ref": "indicator--f51b8ae6-3653-4e29-b837-4da06707981e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5181b216-588d-41e4-85ec-17a74705138c", "sighting_of_ref": "indicator--17e0c2ce-336c-4fd5-8c4f-84054dbe2b6b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--776b22fe-7ff5-49a4-92c5-4b30cf016bdf", "sighting_of_ref": "indicator--955b9491-1b8c-4259-b1b0-7e56eead34f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65ef0b35-af1c-4052-81ab-9861f2e93cc9", "sighting_of_ref": "indicator--0bd5a472-bdc1-4367-850e-faf495cf3556", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e226b3e6-9db9-441a-b458-bd3b14f0506c", "sighting_of_ref": "indicator--8535e8d0-fd40-468f-be37-389bab8a342c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4441565e-e411-4d1c-9a23-e4bbb1e9ba2f", "sighting_of_ref": "indicator--6bbebd4b-8f58-40a4-a2c9-a4626d8fa0f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f0af425-f992-4e4e-b67a-6849fb0e3326", "sighting_of_ref": "indicator--1b875ada-3370-4026-a44c-6d139b16805e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b6f0db6-f0be-4c8f-8114-6d4345955e8a", "sighting_of_ref": "indicator--74ee1ff5-cbca-4b8f-9d31-118a81d68651", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f909a40e-518a-4795-96f2-2b116dd989dd", "sighting_of_ref": "indicator--2c0daed7-ebd4-4b29-a02c-4ac966ec952b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b57a172-d6aa-488c-9a97-aed2972b7ca5", "sighting_of_ref": "indicator--3dd8eaad-2b26-42f1-a867-329186518f6a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--891e31ce-6b69-47b7-90b9-7906baf97234", "sighting_of_ref": "indicator--a7efc4eb-7bf6-4496-97f2-0a7b6c3fe9fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cca0fee1-3b24-4bbe-95c7-a734b5ceb85c", "sighting_of_ref": "indicator--799edf6b-d944-4861-baaf-1c03da6fa8da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46d7a7b-7cc3-419d-8ed8-85daef2b9f0e", "sighting_of_ref": "indicator--3678529c-4acf-4046-b2ad-54827166abba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d089c5f6-be8c-421a-b065-635ff3abc6bc", "sighting_of_ref": "indicator--59005ab6-c094-4d1b-9507-623753035258", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31ebe829-4bea-47e0-9cdf-12227dd3f564", "sighting_of_ref": "indicator--5787ac62-591b-4d1e-999e-5d7a99c1979b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc7f8eb9-d1b2-452d-b229-35686e64dbc3", "sighting_of_ref": "indicator--05a5638c-c10c-418f-bf8c-7ff9ddcab44b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--479f1d41-9cf9-428a-be63-cf33fe38cad2", "sighting_of_ref": "indicator--38bf1d8b-b016-4699-9951-f9f9f783e940", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd943d3-b9a7-420a-9a83-f77918e86071", "sighting_of_ref": "indicator--3a105b69-c410-4ec1-905a-acd36aa7ee57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d915006-b733-4419-9405-9097e385dce6", "sighting_of_ref": "indicator--11229e59-1128-4897-a58c-b89afdc05e15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7844e178-6bf8-4d6d-bbf8-3925e71213dd", "sighting_of_ref": "indicator--f9bcd55b-7132-405e-a104-8de9601450fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf83fa7-a44e-4772-88eb-a36ccbcdfe97", "sighting_of_ref": "indicator--080186d9-56fe-4ea2-8fe2-5b0cbe8d0906", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a09ae90c-e634-40ca-b2d3-b4abba79b26d", "sighting_of_ref": "indicator--df31ede7-619e-4c08-bfb2-78a9280013fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc3a6e7-7e86-40a3-9e6f-4435cc9a4004", "sighting_of_ref": "indicator--dbab3c6c-9cdd-483b-9087-fb24a2807dee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b80b32e-2b3c-4fec-942d-7b321a10c798", "sighting_of_ref": "indicator--8074681a-bfc9-4811-b5a3-3f00bdd0973a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63ee4dd1-efce-4788-8b29-fbc2a1f3aec3", "sighting_of_ref": "indicator--c120c216-8b71-4bc5-933d-65bfbcd75596", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3831139c-a7be-40d7-a77d-bdc8fe1874fc", "sighting_of_ref": "indicator--09291d2e-7025-452b-a804-f08db591d11a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7701039e-ca38-484b-81b6-c018b02acfb3", "sighting_of_ref": "indicator--82e44a7b-cfad-4cbd-82b3-a281f8732f23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20fc2b4-b9e9-485a-802d-5a0368247be7", "sighting_of_ref": "indicator--4c8e9fa8-5abe-467d-a14a-17afe1d93966", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e72c512-8254-4ad2-8c09-03846afc7ea1", "sighting_of_ref": "indicator--d9c260a9-34bc-42ab-ab4f-9a34275f72fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c82fff-3488-4f62-8309-607d27009fa2", "sighting_of_ref": "indicator--35daa9bf-54eb-4c1e-a3d2-ad5baf6b06cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630ef67f-e96d-4451-aa96-3764d72d5766", "sighting_of_ref": "indicator--9eaf8710-4989-44cd-8a0b-43d8f47bfd27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afcbc44f-f013-42ab-821a-c19818d9c468", "sighting_of_ref": "indicator--d7c95ec1-0794-4ad3-b424-5335a00c8ca1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d1d5d9a-adf3-4175-9cdc-0262e2bf3fa8", "sighting_of_ref": "indicator--5897af15-d9d6-49be-a56a-2142048d5ba8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9085b0f-43bc-4b03-962f-c04956606a63", "sighting_of_ref": "indicator--9c0aa248-3e73-4567-9f1a-a0b9a50f92ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48db8120-4e04-41c1-80e2-90e04be12849", "sighting_of_ref": "indicator--dcbaa49b-30d2-483c-acb2-bf63e693203d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff6358e7-b956-4ed3-96d7-7941fd2c3bee", "sighting_of_ref": "indicator--1d2b2c46-7d85-4a30-92a0-9df9cbabe060", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bbc8b56-6669-4c1d-b538-5c2acee2afd7", "sighting_of_ref": "indicator--4b613dd2-bebb-4ae4-b033-f76685bd4a4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d419d6-96c6-445e-aefb-632ef19c3f60", "sighting_of_ref": "indicator--bf41cdc4-ebed-4588-989d-c03659bad52b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed99b8de-1934-41ba-9155-c8a3e8fb2e2e", "sighting_of_ref": "indicator--0a3382e0-d285-46c9-9072-5908f4e6527d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a8672a9-bf2e-4cba-b972-b0479a9a1ef7", "sighting_of_ref": "indicator--da7389b7-af96-48dc-9bae-f700216f066c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba17d9e-017e-4535-9d3e-d739ada0a394", "sighting_of_ref": "indicator--32d2cda0-ed46-434b-bca1-d71fce065c0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0b9bde7-b309-4caf-bca8-d0e3adc566bd", "sighting_of_ref": "indicator--5389363e-55a2-430c-af33-0e8fd16f3ab4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3638516-8604-428d-a850-9e986b343623", "sighting_of_ref": "indicator--b7f2f903-050a-4360-931f-aa5026e86cf7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c1f355-702a-4076-b122-8951216d930f", "sighting_of_ref": "indicator--23eef671-2b4b-43ba-bd7c-20481a82e6ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8032ce85-6144-4efb-b898-80bb9c7284c6", "sighting_of_ref": "indicator--68d6a54e-3d30-4db0-bc95-a7caf16579eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3def8c33-fc06-4096-99e4-aa3c2e9e14d3", "sighting_of_ref": "indicator--fbb179ba-9f4c-45fd-9e97-e79559681c81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3853f56e-9898-4007-b823-075ef600406b", "sighting_of_ref": "indicator--5115f906-cb1c-4025-99b9-6f72d54dc96e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d1e543-6099-4ed1-a374-20f8821ac607", "sighting_of_ref": "indicator--333dfd72-fdc5-4971-874b-0453b6555b96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e128720e-5240-4e0e-9d01-288eecfa38f4", "sighting_of_ref": "indicator--639e9f44-7d5b-4d1a-9eb0-f012987004d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6fd6d74-f59c-44ff-8b06-417fed000f3d", "sighting_of_ref": "indicator--1b7cd361-c12e-495e-85fe-84716e2fbd87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2437d6ad-ebff-4239-8c1b-9ed667bf41bb", "sighting_of_ref": "indicator--e86c0bd1-8878-4d38-a749-2f8366c5ea45", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b14256-16ef-4703-8407-93660b892162", "sighting_of_ref": "indicator--aa64b457-6c91-4b5a-a5f2-844904b6abfc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f8ed727-9631-439c-90cb-501ded0692e0", "sighting_of_ref": "indicator--347eff51-599b-43e9-b1e7-0fc661151e27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23dec1eb-4442-4c9b-99a1-5d340d2b457b", "sighting_of_ref": "indicator--a76e855b-ad28-4b9b-a4c1-12bb42115f77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d99a04f-7b2f-4aaa-9587-bfc2360d4dd1", "sighting_of_ref": "indicator--8ae20cc1-fa95-4aae-86ce-95b6f5ea4226", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d394b4a-2ecd-4e9d-9905-390e26e8bcc0", "sighting_of_ref": "indicator--df3b990e-bef2-4a2a-9a2a-14d10c18410a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7af86c6d-0f67-4ca5-959a-552da80204a5", "sighting_of_ref": "indicator--37c3a9a3-3d15-4abe-b501-afea008d39fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae75946e-fce1-4478-9540-20bf39e3ebf9", "sighting_of_ref": "indicator--aa54166f-035e-40fb-aff8-65423840b652", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21ec9559-260c-494a-9a05-1abc6c13f8ff", "sighting_of_ref": "indicator--e813f48f-818d-4cb6-b22d-ec40aeb37e16", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdb82fc3-8261-43c6-9e50-b989edc01000", "sighting_of_ref": "indicator--9e1e8211-cf14-4276-bfa8-12c67c4a92f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0617db8-5e74-465f-a34d-d7c411f65fb7", "sighting_of_ref": "indicator--ffb70033-b1b8-406c-b42a-bf0e5f532f39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d497fcb6-7b03-46e9-b28a-fd6c187b181e", "sighting_of_ref": "indicator--040d2a41-767f-4ad8-94fc-cc9091d47560", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f0c990-7c18-4928-8699-6e35c20adb8d", "sighting_of_ref": "indicator--b591896c-3dd7-48bc-932b-ad28640eb941", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be1d22cc-9b31-48b5-b111-2d3f5acedce2", "sighting_of_ref": "indicator--4335b8a1-d84d-4a09-9333-6dbd942402d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d83b39-888d-44ba-b743-cb0634963d21", "sighting_of_ref": "indicator--71680750-b1a5-4b01-b311-296b2438bc9e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e924bfda-d197-4a02-a171-970c9b0ec882", "sighting_of_ref": "indicator--c74a5821-9a85-49d6-a3ca-f37a99a2f70f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c33d912-2d85-49ff-8707-94fda78ea1ef", "sighting_of_ref": "indicator--c011882e-62d0-434e-9400-bfc88a5a45ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5062c1e7-12da-43b2-bb7e-98a5b74c9779", "sighting_of_ref": "indicator--f7a03557-980a-4c5f-a6c9-471458051407", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5a93ec-9227-4a85-879b-27e1054a5265", "sighting_of_ref": "indicator--c39a2cb6-ffa4-409a-9976-8c012a97b5b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f502d0-b130-4b02-95b5-4854975af0a9", "sighting_of_ref": "indicator--b65e290f-2137-4021-86db-4e06cf164b58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0640396-5e83-4e53-bb9d-0f028d2602ff", "sighting_of_ref": "indicator--63c8fe9d-37cb-4b1e-b849-545fa35cd4c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--816f35eb-1a74-405d-9e74-f8e921cb593f", "sighting_of_ref": "indicator--19c75a5e-a355-4c7d-a2ad-15de7b81ac9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b240d0ad-b800-4bd0-b86d-bcbfa266fb03", "sighting_of_ref": "indicator--0de2d690-4474-4c57-a7c6-fd3205d6c472", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5be0e7a-923c-4fc1-8fcd-ab2dabea8f81", "sighting_of_ref": "indicator--791b8c99-1681-404c-9986-650bad3c6714", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db85ad02-1f88-4855-bd18-e2b87bf5bc4d", "sighting_of_ref": "indicator--852813ce-7dde-4a9a-9e99-5691a3e83551", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e8cf81-2a7e-4870-a424-da2993f3bbcc", "sighting_of_ref": "indicator--cb561c6a-c915-4f5b-af6c-ab21f427821b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67a9e9aa-6cc1-48f5-ab8e-faf5b73976f3", "sighting_of_ref": "indicator--94cfa9c4-6581-4301-a0d8-adcc29454903", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d92174-d815-4cf3-b564-1c9628781419", "sighting_of_ref": "indicator--69a89460-c42a-4783-9ffe-31f13d993e4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb312014-e115-418d-a795-b24f1be812c2", "sighting_of_ref": "indicator--75cf463b-86fa-4c94-9baa-90b102aedec1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35acc525-6781-47fb-a105-7519cc7e149f", "sighting_of_ref": "indicator--98797b78-ca9a-4d5c-b519-2cdc21e24956", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4951bd9-cbde-45f8-8742-b73611ac7433", "sighting_of_ref": "indicator--749049a4-9a3e-4bf8-99e2-a067d8f2d8ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eecc285b-ab40-4da3-b228-cf1fa79f791b", "sighting_of_ref": "indicator--57dacc47-0196-41a1-9ce4-ec069b33c480", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e57a3e92-1f91-4471-9189-1288bde00f37", "sighting_of_ref": "indicator--f5bd5e04-0379-4b87-ab21-7636b9bbbdb5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fefbeaea-6c18-4e62-9256-fedcd1379f21", "sighting_of_ref": "indicator--00b98f8b-224c-423b-9edf-bcac53e519b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68e60087-b522-4458-8716-c4aa68421b46", "sighting_of_ref": "indicator--a432efc4-8878-45ff-8935-a66b7d048868", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--641ff7cd-a616-4367-8a58-2b882cdc4e29", "sighting_of_ref": "indicator--b0eb1645-672b-41e0-86ba-6936c17231b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee18ef9b-94fe-4980-ad29-458ca082e650", "sighting_of_ref": "indicator--23cdcddf-ebc3-4020-b64e-63dc68a0bf24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d76e0f6-b43a-425b-9887-b07da66d37b4", "sighting_of_ref": "indicator--b59685c4-d9e8-4df4-b298-6901b6cbb051", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bcb2bd7-f24b-4e6d-bf2a-0266070348cd", "sighting_of_ref": "indicator--a59c5607-6b00-4797-88d8-dd34e48d4e1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b5100c-1cfd-4a9e-b8e6-f7932ebb53d1", "sighting_of_ref": "indicator--500e0ca2-fd59-4a5c-bd93-e2433d81d002", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e34a31c-0876-4da6-a6b4-aff09121869c", "sighting_of_ref": "indicator--cfb291ce-0527-404c-bb72-c0fac8c81853", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--432063d6-fb8d-4e29-a26e-e6041e30f2da", "sighting_of_ref": "indicator--27a570be-4d15-4c66-b70a-c2f77909b271", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12cbb956-232c-44ac-9cf9-f3af92af997f", "sighting_of_ref": "indicator--97cfd7b8-7963-460d-8978-93c12963300f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2039658-80e7-4142-86ac-cdd7cb5ca5cf", "sighting_of_ref": "indicator--77955a93-0898-417e-acff-f60cbcba25c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b88bd0fa-4450-4e57-9a03-c6d2ebd79c06", "sighting_of_ref": "indicator--60c9c471-4a73-4290-9e69-b1ec0d86f456", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b312af59-2e9d-45e8-bbb8-062421593dc0", "sighting_of_ref": "indicator--60c9c471-4a73-4290-9e69-b1ec0d86f456", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f96656d-af34-448f-b32c-f39ae01884c2", "sighting_of_ref": "indicator--f0fdb242-049c-46bd-887b-ff60b19583bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37caacf7-baf6-4e91-9f5a-884de8ec09d4", "sighting_of_ref": "indicator--fb89a082-57df-466e-9556-9a624eb99b52", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a7fa5f-4a64-4e0c-bebe-7c8d2ecc16df", "sighting_of_ref": "indicator--3ccf8ae5-9aad-4f0b-b12f-14e1e7a08ff0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8c675d-5083-4221-9012-c797678dd566", "sighting_of_ref": "indicator--cffdf215-25b5-4bda-bb31-2974da74ab35", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642a523b-2c48-4107-aaac-d1c01a4e9846", "sighting_of_ref": "indicator--e4ee6bd8-616f-445a-9664-fa55db41ab76", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8fc78c5-fd7b-4237-ba07-eae2ebbd975e", "sighting_of_ref": "indicator--b54fd5fc-3a34-47a7-916e-48c325b94abe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f32fb6f-7c4a-464e-b961-2846b5c02561", "sighting_of_ref": "indicator--5c3aa416-cefc-4d05-9456-1153b1b1679d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b979d21e-e032-4ccb-a027-d9d0756bf86e", "sighting_of_ref": "indicator--b1deba8a-1e5a-49c8-a947-6b2001091a29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f3963c2-7776-4257-8a05-d5c95c30e64e", "sighting_of_ref": "indicator--fdffbbe3-dacd-44e1-9c3b-2c95804abd9d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61bd26e4-36d5-4880-b316-e627ad1e0bda", "sighting_of_ref": "indicator--e89fa90f-77e5-47bb-8626-ccdb31d67228", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b678d827-0da5-4ecb-b4f3-77df8bf37ec5", "sighting_of_ref": "indicator--a1eb27bd-57aa-4989-be8b-08d75781c5ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92eefd66-6e20-496e-bbfa-895bd9a7ecd1", "sighting_of_ref": "indicator--aaab4b25-6ebd-4a7b-b8ed-4f3aa43d2074", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ef8176-d9ec-446b-a853-6447d70b0361", "sighting_of_ref": "indicator--caca74e6-61e8-4a37-a70c-c0fe46c4d4a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe49859-d8db-4b41-ba77-1c6854280265", "sighting_of_ref": "indicator--f3e637d7-bc14-45ba-8bdc-69eab94b2462", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6123d677-2e8a-4541-ac86-6b1a65036949", "sighting_of_ref": "indicator--063ea47d-5e97-433c-99a2-fefc10b1440d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0721e303-eac5-4566-bbeb-d843dab64968", "sighting_of_ref": "indicator--29a77710-8e30-4093-baa2-5e79a1539c68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62732b14-958a-4b7b-a6ef-7ac1e356a945", "sighting_of_ref": "indicator--6505ceeb-039f-47df-aeff-cea026e5b88b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56d3ae85-8f81-454d-863e-b5d0f7ada652", "sighting_of_ref": "indicator--fe069878-0661-43e4-a766-095d36f47037", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73164d87-ca07-4158-9eea-88dad06d3264", "sighting_of_ref": "indicator--3faed274-48ae-461e-b724-41aacb65b668", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf1a2914-9eb5-42d4-bd1c-9feb7d09cf68", "sighting_of_ref": "indicator--de681699-2926-4a74-bb12-03d7785f08cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90a31d66-4537-4cae-ae87-b3fe1b443978", "sighting_of_ref": "indicator--7a5a307c-2f8a-48e4-84cd-cf8464b8721b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84fc659-fb27-49f2-90ea-b529b6f56518", "sighting_of_ref": "indicator--23606eb9-a4f2-4062-ad3d-8da481d81fc3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a17dfc-d95b-4ead-87c5-f10dbe113d83", "sighting_of_ref": "indicator--a1556d34-4467-4e7f-b3ff-baa7da9668e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cdabab1-b646-4c9b-a8d4-14edfb6165c2", "sighting_of_ref": "indicator--e057d225-233c-49c7-9990-f3863a32fec1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eb580d1-60ad-4d4a-b3f9-1f96d26fa39f", "sighting_of_ref": "indicator--947622fa-5927-418d-955d-b4302e8bbd33", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4bd239a-40ae-44c0-a6fa-8d62e41da496", "sighting_of_ref": "indicator--c4f2bb2d-a0a1-42ee-bbed-82bc45519b17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1424b28-67dd-416f-990f-e72b347f12d4", "sighting_of_ref": "indicator--681f63d5-09d6-445e-b44e-2065f829b5a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--359d2ab0-bb3e-4c9d-b630-9f6994ff40cf", "sighting_of_ref": "indicator--d0b00ddb-df95-4814-be8b-7004695b6656", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d48da812-b6b8-46b5-b35a-1e154dd95603", "sighting_of_ref": "indicator--da595531-64de-4d44-962f-cd53f9fd898c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--daaf95ea-e1be-45fc-9b03-56d9ab225c64", "sighting_of_ref": "indicator--9fa03e30-a6af-400b-9cad-94a18b9d6e98", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0c1d0ac-9853-48f2-b3ee-184f333c0259", "sighting_of_ref": "indicator--e1642bfb-f782-48b5-8671-986bc7277c94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c810567f-e311-421e-a935-00c311b91ce8", "sighting_of_ref": "indicator--b7016edc-3e79-4569-9e24-5cb883f630b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ea2a37c-0eb6-4b23-9209-a522036f965f", "sighting_of_ref": "indicator--96c97829-f129-416d-9aee-28bcf747bcb6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43fc646d-c24b-4d43-b7b7-1d62000e2703", "sighting_of_ref": "indicator--75812ba3-0d68-4a34-a122-30e28499bff6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ddcd579-ea50-4c31-9d8c-452e8bcd65d0", "sighting_of_ref": "indicator--fcc3bb90-f3e7-4167-8bc1-04508b0b710f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba1a2ac2-d8a3-46fd-8b3a-efcaa2644044", "sighting_of_ref": "indicator--f846f39f-5662-46ec-b8f3-940e8683d9fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--849c9bc7-c6a6-4a2c-b32a-615e5f344f98", "sighting_of_ref": "indicator--acda3f3d-01b2-494c-8f5c-728541cfd15d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a97625-1fa0-4522-870a-985001211c8f", "sighting_of_ref": "indicator--2d18c4ef-0f33-4f50-83ff-d21ab7c018a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739a5e7f-1b0f-42ed-9cdf-802162634f49", "sighting_of_ref": "indicator--dbeda1c2-e646-4e09-a0f8-029fe35fcd63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f1edc41-4c0b-43d6-883a-a9c372b22a61", "sighting_of_ref": "indicator--cf46a694-4c91-4efc-9599-0344d1061394", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538bdbdb-181b-44c4-9235-8936ee154eff", "sighting_of_ref": "indicator--09c74626-7a9b-4b12-af7a-e7b46520ab0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e990ce9f-b0d2-4123-a391-032875d65476", "sighting_of_ref": "indicator--589f2586-c89d-4b02-a092-16adae12642d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02f4ccc-c126-4fa6-819d-01dc2d1a55f4", "sighting_of_ref": "indicator--33d62824-1c7a-45ec-91e5-69b5cab5558b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c4607d5-e612-43a4-a242-599c653f104b", "sighting_of_ref": "indicator--b11d3fae-de67-4a4a-b246-35a57ed63269", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2a31919-24a0-4ab4-9871-59684e6c9d8c", "sighting_of_ref": "indicator--b7caafa8-95ba-475d-8ef3-9d8813e5614d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b2b1803-a2fa-46a2-808a-0196b47ad72d", "sighting_of_ref": "indicator--bb69824d-b154-419b-aa65-fbeb0689a050", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43e7a4a0-e1e2-4354-8831-d652924b4348", "sighting_of_ref": "indicator--49626b04-6a8f-4bad-8d83-f3dafe17f7b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a565ab99-5781-4213-8f93-2eaf90b40a70", "sighting_of_ref": "indicator--bf904f72-1ebd-4f54-bd76-0ee6ad15bbf8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--542c623d-321c-4f34-a2c2-cc0d4eec22ed", "sighting_of_ref": "indicator--cdbbf40b-2d76-4142-9716-ebdafd18a36d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec23e95a-a600-42e2-bd3c-00fabb3753a3", "sighting_of_ref": "indicator--b4fd540f-83d5-45b4-aba2-472b27f22aba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be14d331-4c51-4ba6-ba27-3060250b7fcc", "sighting_of_ref": "indicator--80794109-b0f0-4dd5-bb03-e4a774fb06f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f296e184-75ae-419d-bdae-41627c530ef2", "sighting_of_ref": "indicator--2d4ad4ce-0c33-4122-8bde-bd629ce3bfd8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b8718ab-261d-4b53-8972-5860b24bef91", "sighting_of_ref": "indicator--af264fbf-faad-4936-ba0c-e464fc2bbb01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d265feb0-ae09-47ad-bbd1-1a1536a670d7", "sighting_of_ref": "indicator--0ba32967-2b50-4ab1-ac52-57eb77a918ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea26c2e6-8d2d-4046-919d-7d407375ee01", "sighting_of_ref": "indicator--d577f455-01d7-4753-b7c9-ed4dc4c0df73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61917b28-a0a6-4811-b31b-42005219d751", "sighting_of_ref": "indicator--354697cd-aeb1-4f55-8eac-8139edec39a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51505fa1-81c5-4d8f-a912-6dfcd3c3506e", "sighting_of_ref": "indicator--efc86e9d-20e9-4b7e-859a-c1dc01a42e17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c337e05-00f9-48c2-a81b-fd208b6102db", "sighting_of_ref": "indicator--616e6dcd-3f08-42a8-a55d-f6c7e7eb6fca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f323b81-900e-4305-9b88-32f5c31069ab", "sighting_of_ref": "indicator--b80c5a93-c9c7-4043-989f-d40b7906b50b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2386833-e668-4788-a846-bca86eda2e8c", "sighting_of_ref": "indicator--17043c9f-7ec8-4f03-aca7-841fab6bffaa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c05f9f-6456-48f6-9d82-30b10f3191e3", "sighting_of_ref": "indicator--0c6e7d43-b006-412e-a485-a89f134baab0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f9ee5c3-6adb-471d-bec7-d856f63c6b8c", "sighting_of_ref": "indicator--4143fa5d-a330-4472-ba72-dd28e0578dde", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42bc1f08-fea3-4876-a6fb-b66b2ae3d695", "sighting_of_ref": "indicator--e9c211f9-6d68-49c0-be10-059163dfab6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3379d19a-6848-419f-b0b9-008563e5308b", "sighting_of_ref": "indicator--8292322b-460d-460c-aa68-1e6afb530504", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93490aca-eb3d-405b-beca-f9579ad41e64", "sighting_of_ref": "indicator--294fab36-9674-4c10-953e-4444d907030b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b29aad5-52ec-44aa-bde6-899a2609eced", "sighting_of_ref": "indicator--4d9e4b7b-11ff-437b-b50b-2655f3eba391", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59006b0e-00f1-4b23-9920-63e6197b269b", "sighting_of_ref": "indicator--a32a78b1-22da-42d1-b7fd-c75a4031743d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95922935-d257-4dd6-aa02-573768b734b4", "sighting_of_ref": "indicator--a44a1049-2335-4f15-859a-3c7b484817e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--473dcb9a-eb9c-4b59-a880-7a2533bb632c", "sighting_of_ref": "indicator--eb224e23-8cfc-446c-a9ed-499f93bc783f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d0163ea-b3d2-4a79-9a83-19bba40ddd69", "sighting_of_ref": "indicator--a1498f2e-11d3-4961-8a57-78a74a7f2e79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70569ccf-8171-450c-843f-3d6223ba13f5", "sighting_of_ref": "indicator--17cf6e86-ba21-43a4-a7f7-3fcfcd09c058", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e06850-9a82-472e-b1ea-d8166d45a045", "sighting_of_ref": "indicator--0a48d922-4617-486d-857a-5b19994b67e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33e6b4d0-9f89-4799-b4ef-f5465a3a036a", "sighting_of_ref": "indicator--bcb62890-d26f-4029-8944-30aea546ef45", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4bdf282-fb74-4989-9e86-b74628bf4b8c", "sighting_of_ref": "indicator--58d44723-3ad0-4ca4-9fbc-5292c159321d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb143b39-409e-4f0a-bc56-0cd83cef0bb8", "sighting_of_ref": "indicator--1a2e3cd6-319a-41ef-806d-7b5e7b79cb11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--691bfd91-2ebd-4e4f-9f0b-269378337e97", "sighting_of_ref": "indicator--65449c85-a557-4b11-95e4-e67915e82252", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab30dc01-e3f1-4aef-b18d-fc455c200bdd", "sighting_of_ref": "indicator--de00b4b1-f47b-4788-a7ac-2c829611fc6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--316d9405-036d-4db8-b9d4-e6a7820bde66", "sighting_of_ref": "indicator--a4d14203-5cd6-4ab1-bb7d-285388d2a05c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c273d65b-15ce-4c34-aa28-ba9ad8889129", "sighting_of_ref": "indicator--f2bec189-31c7-475e-8303-7a8a1c058c2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb410b9-90b8-4422-9f93-74ca80a36b8f", "sighting_of_ref": "indicator--8168a3ab-4a36-4a41-97af-cdd97af175e0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe18e7a-a1d5-47dd-8d07-a4dccb05d78b", "sighting_of_ref": "indicator--44e7f071-d049-49fa-bb5f-5d966b2b970c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9627e7-340d-4ca6-a405-fa1203b97aa9", "sighting_of_ref": "indicator--39cc9687-3737-4d6d-801e-32135761facc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf27afa-fe19-44db-aaff-068d82370591", "sighting_of_ref": "indicator--24c90b0a-f8d9-48e3-a179-03ac0e4b471a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d91e37-07a3-49ea-b106-303ccd6943cb", "sighting_of_ref": "indicator--5c904b7b-55e0-480b-81a9-77aed3269690", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69bf58da-9f79-4cc4-a9a2-a6ec042190c7", "sighting_of_ref": "indicator--3d6a94b4-193d-4858-8691-2d1a2bf98d52", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4376e3a-76d0-42d1-a990-af9c23270c93", "sighting_of_ref": "indicator--bfc0ad69-22e1-4db7-9fa1-bc996422efee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--847ec6ac-4411-430a-b0f4-9ef190099c0f", "sighting_of_ref": "indicator--65b83e9a-6406-4ddc-8d03-b7d1cea3c5da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e52dafb-d64e-447c-a327-1b1c19d6c994", "sighting_of_ref": "indicator--1a9e8f93-c72e-47f2-ad3f-ca5f324e92d1", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--679da6b6-1580-4e24-b25c-a7d044eaffe6", "sighting_of_ref": "indicator--c94aba87-2d16-439d-987c-73f30f3c4572", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae67590d-edea-4f58-b78f-9507e8c2c339", "sighting_of_ref": "indicator--1e9db45a-3d16-4283-83f2-e68c48e9a42c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4617e05f-7983-4a82-9614-d83e7fc061d5", "sighting_of_ref": "indicator--575c4d01-77d8-4d13-8ad0-2cbb60e7a005", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe4a8b2c-0817-4b42-94dd-b00ede4985c3", "sighting_of_ref": "indicator--a4bbda38-2219-4c30-be7b-62f9fbff1e28", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7709ba8-15f3-4c76-a699-6006cf8a391e", "sighting_of_ref": "indicator--ba1c8243-68f0-42d9-a8b2-49c7eeaed474", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--676baf60-721b-438c-af2b-236b43fbaf9b", "sighting_of_ref": "indicator--4e71dbf2-3d26-4a42-b023-5e23fb990b99", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c31b2c28-5b7f-43bb-b76f-abaf565ac2a2", "sighting_of_ref": "indicator--a9f6541f-37e1-444b-bc21-0cf37e248879", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fdb4906-44f9-49cc-aede-9bcd79e91935", "sighting_of_ref": "indicator--5d039d28-5019-415f-8bac-5f22e85d6667", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb3ef5c4-890a-4c43-bc13-e739cf1831cd", "sighting_of_ref": "indicator--f1496467-6e71-468d-b5a3-3fd07660ddbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b918a98-a6df-43eb-b87b-877e3da5e284", "sighting_of_ref": "indicator--f66ee9f2-bf23-442f-b848-ca9ce8575c66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55f10ae4-d2c2-49ac-b8b6-39a317baed1c", "sighting_of_ref": "indicator--9e7142fd-f52c-4c41-8483-56a35df4aca8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf65e5f-f5fb-463a-ad16-707924e6bd2b", "sighting_of_ref": "indicator--ec56e9f9-d064-483a-8355-26e99e8276e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e31729e-c2f3-46ea-8b2e-c53e0351dc47", "sighting_of_ref": "indicator--95aef1de-655e-45e6-a1f4-70b1a52d6212", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd7562f2-fb8e-4eed-8722-4ed110ace584", "sighting_of_ref": "indicator--a9ed1f17-886e-4175-85e5-adde343586ba", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad868f5e-cd9b-4d62-8aa9-ab21cb344a2d", "sighting_of_ref": "indicator--cbbcafe9-7e6c-43ea-bce8-8e8f45eb040f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcc8cd68-cbc5-4969-bbfb-dba718f89b88", "sighting_of_ref": "indicator--7614a05a-ace0-4e0f-817c-c7c9f579ae05", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66fdc3f-e93a-4cdb-b459-4343198613d9", "sighting_of_ref": "indicator--3ff7b0c6-5680-4ece-aaf3-8634d2bf90e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc1da10-f809-4e5f-aa1a-eea93b536ab2", "sighting_of_ref": "indicator--b2908524-3cae-4f87-8b52-113a1d9e7f84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56dbcad9-2a3a-4c0c-a7af-5e6f0b24dc83", "sighting_of_ref": "indicator--31d80673-247a-45ea-8b00-47e1a22d43fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a5c52a4-a4e1-4b03-a7f1-2c036515c143", "sighting_of_ref": "indicator--ebfcd9b9-9dbf-419e-bc83-ef45ea1d8a06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa60fd72-1266-4eb2-8bdd-71e20d4637ab", "sighting_of_ref": "indicator--84bb03e7-7710-41a9-8909-41b6b0c32e0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b1c5cc-56d8-41fe-a10b-ff78b8066cca", "sighting_of_ref": "indicator--9c1e10a6-a48b-4b53-a33e-9716106a5c98", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fd7768-26af-4297-b2fd-bd773ecdae01", "sighting_of_ref": "indicator--2f602920-cdcd-435c-acd0-7ca5c5d27ec2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f224c235-9ede-45d5-bfe0-4bcf724871bc", "sighting_of_ref": "indicator--8b9477b9-ccef-4077-8b12-b94eebda39d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef36a73c-f17e-4628-a02c-db0a377b1697", "sighting_of_ref": "indicator--732a6380-0623-4a16-b561-691ee50ceff9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf056bde-8343-46aa-a2cb-8bf35aff9513", "sighting_of_ref": "indicator--2f5f8bd1-bbe7-40d1-b980-466578dc77bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ba3ad2d-af9c-440b-b172-8fccc6ed229a", "sighting_of_ref": "indicator--1d8e3bd2-a49f-41d9-89c4-8cccb53eee49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e3a9e57-8a8e-4485-8d39-18452d669324", "sighting_of_ref": "indicator--7fdc1490-faff-4c5b-a930-b3d886d821e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36439a2-65dc-4056-b94f-222bce57816b", "sighting_of_ref": "indicator--ba7f93eb-fec6-4aa6-8974-2e2f6222a077", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0df38f5e-f4e4-4a41-8396-debfec003547", "sighting_of_ref": "indicator--ecde5795-ae05-4afd-aebe-b095f9b53ff4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7765a0-1a16-4a62-b858-d429762ff272", "sighting_of_ref": "indicator--71c6980d-9a00-4349-a7c0-7d2eb23e6d76", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93a5dac2-e678-4fb0-9ac1-b618fa71a55f", "sighting_of_ref": "indicator--af6b44c8-0304-4ac9-8f80-ad564e9d049f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31ab61c-c312-418a-948b-5979b54eaaaa", "sighting_of_ref": "indicator--a3bf1fd3-e7c4-437c-8b31-4501744844fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aeb4f475-eaae-44a5-83a0-f43c6294f234", "sighting_of_ref": "indicator--463f787b-ba31-4d54-96b7-83542e342160", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc002702-9f23-4cd7-91d9-c29320b264b7", "sighting_of_ref": "indicator--e3d93ec9-4692-4117-85d8-7f98413857d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e289308c-5bbb-485c-bae3-2a600371e569", "sighting_of_ref": "indicator--8744721b-8e65-4df2-b099-42506dde1a87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ebf7f16-8923-4093-8634-ed1dfc8a2571", "sighting_of_ref": "indicator--2884c984-b7b9-4bbf-a2de-463321ca8006", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7637ea7f-db77-4dcc-b5a4-0d287dddee3c", "sighting_of_ref": "indicator--27422970-fb4e-4c68-8922-26b9341cdd84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ae64276-02f7-4b1a-acdc-5ad591774ccb", "sighting_of_ref": "indicator--e20be5ca-89fb-46e2-b986-2095286a41b7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bce2e71-3cb6-493a-8bcc-c8c32a334e9b", "sighting_of_ref": "indicator--06ca0532-e109-42cf-babb-b4ce4e94cbcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36a9439f-aa8d-4135-bb6f-ef97333ad824", "sighting_of_ref": "indicator--ad1b60eb-54e5-481f-b941-4cc7c61dc554", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e41060-2eb5-416f-a183-6d75b8c351e3", "sighting_of_ref": "indicator--ece11f31-e0eb-424a-813b-527b4d98a985", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46358931-9ddc-459b-86ba-7942a83e20d0", "sighting_of_ref": "indicator--23086fce-8d9a-4852-806c-3c48a377293a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afec41bb-e9ac-426e-8b7b-0dd241beaea1", "sighting_of_ref": "indicator--6579ab2d-2be2-4e94-b613-227f4fc802af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfcb335f-9f28-4a27-8e0c-af35c0f340a2", "sighting_of_ref": "indicator--fc15e20a-7d58-427d-803f-28f235c69e97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d26dce-3254-46d9-9aa0-f294c884ac8f", "sighting_of_ref": "indicator--52d73792-70c7-41f7-bc56-280ceaab444f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db3c145a-8514-4813-aaa5-666d3f0b74b2", "sighting_of_ref": "indicator--8a702cf3-8bf9-45f0-8afb-4831d28a31c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6afb5e7-6a4a-4790-bf5c-c10ab8d434d5", "sighting_of_ref": "indicator--094b9ae7-e42d-4a4c-8feb-e9e2e0d3d2f6", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2477113-996b-4015-9872-0817a0315480", "sighting_of_ref": "indicator--094b9ae7-e42d-4a4c-8feb-e9e2e0d3d2f6", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--191b4991-018a-40fe-aa41-f043c147aec7", "sighting_of_ref": "indicator--094b9ae7-e42d-4a4c-8feb-e9e2e0d3d2f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83824304-8830-4d31-b4d1-e38f63272269", "sighting_of_ref": "indicator--35815a0d-d7d0-43e5-bdd1-9cfc3c4528b0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dd261c3-74c9-4f22-b26a-411e8585a512", "sighting_of_ref": "indicator--35815a0d-d7d0-43e5-bdd1-9cfc3c4528b0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd182da6-3417-49c5-94d9-ada68f1851a7", "sighting_of_ref": "indicator--35815a0d-d7d0-43e5-bdd1-9cfc3c4528b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc0c8d8-497a-4e22-983c-27b797ca7d38", "sighting_of_ref": "indicator--b5b5e627-479f-4731-865e-da17f002812f", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b944dfeb-c58a-440d-9575-4aa07c64d419", "sighting_of_ref": "indicator--b5b5e627-479f-4731-865e-da17f002812f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33e97962-7c6f-4f6b-86a4-7fddd5edb123", "sighting_of_ref": "indicator--b5b5e627-479f-4731-865e-da17f002812f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a9520c-8c57-4636-8d99-38895ad4414b", "sighting_of_ref": "indicator--baad1aa8-4da3-4e9a-83c9-fa2fc8fa84a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac74d9ea-2141-4823-96d1-298e83c0a78b", "sighting_of_ref": "indicator--e351e5d0-71e0-40f5-87fb-a4cf09832a19", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6e2fb64-5653-4a95-afc0-282bc4053748", "sighting_of_ref": "indicator--b26b1fee-89ba-42d2-a3ea-0a08cea019b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1376c32f-d933-4528-bdaa-0a1fbdf2ed87", "sighting_of_ref": "indicator--b4256146-3567-4f3e-bd61-6726dbf01f8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf43fcb6-a20e-4234-902a-e6aad6aad598", "sighting_of_ref": "indicator--c9b8cbc5-5cd9-48be-b154-512d58cdb72e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b8b6faa-13e2-4448-b09b-7fe38c431c9e", "sighting_of_ref": "indicator--da8f89a5-09be-4f52-9762-b3eb4f901929", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f250ef6c-b4db-4dcd-b891-d0d3fe84cee7", "sighting_of_ref": "indicator--1e9bcfbb-e1e3-40f8-ba28-1a782ac0a040", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1212b47a-a56d-475b-8141-ec9b804a0afd", "sighting_of_ref": "indicator--8f372fa7-0fce-40c6-96da-7e6b6e6b31b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11079f4-212f-4a91-bc37-2a7eaba265f6", "sighting_of_ref": "indicator--8dd6896c-4d21-45c2-ac9e-cd6acf5ff4e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f711beb-5685-46fe-8483-c49f52fd5728", "sighting_of_ref": "indicator--7162527e-8828-469c-a10e-6dea814acce6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e1ceea-9c3d-4a89-ad4e-c644e9dfeb23", "sighting_of_ref": "indicator--f80e7145-08a9-45e2-b94e-0f1fedeb90d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54a83910-a291-496d-b1d3-ac3453f076bf", "sighting_of_ref": "indicator--0e73da31-a3f4-4099-94e7-8c672935eb0c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41a083ca-e42c-4caf-8717-4d656f0e781c", "sighting_of_ref": "indicator--c3730d50-b309-4455-82d6-1fceeb829f7c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65e610ea-2b2f-4fac-b677-111fd304b357", "sighting_of_ref": "indicator--71aaff62-f748-4b8c-b414-971d8d1dee44", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7b5b0a-4b3c-419f-b472-b414c69696a8", "sighting_of_ref": "indicator--449eadab-7d63-4eee-b2f3-921a9c8d0255", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cdc6c8b-7b4a-43fd-8aa7-960ae266accc", "sighting_of_ref": "indicator--d620ed54-91ae-47d9-8a2e-c3fad806f117", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a5aaf8-5222-4d47-acf2-df4b386c25a7", "sighting_of_ref": "indicator--9a1ef33a-7e8b-42b3-9ce8-993c0d271946", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c978223b-08b7-4566-953e-d174a5230b01", "sighting_of_ref": "indicator--03c0fa17-27c7-4f2c-8ba5-289c552f8d5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdbcfc4d-60cc-4824-b38b-ad9a30724653", "sighting_of_ref": "indicator--7c28c956-9aad-414e-b721-f42c52dd23f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0992df0a-9e2c-4e8d-badb-9a348f638b56", "sighting_of_ref": "indicator--11d945f4-afeb-4f32-b9e7-ba8b5005186c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8fe4d2-c4f1-4ea9-af66-759c718fccba", "sighting_of_ref": "indicator--cd38e0f0-20d4-480a-9834-0abe50120c71", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0df50ffc-ce8e-430a-8b45-278744b8dfda", "sighting_of_ref": "indicator--27b14763-540b-48dc-8575-94a0dc68670a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e03d791-93a5-4245-94bf-016d853d16d4", "sighting_of_ref": "indicator--98d40017-0718-4d10-8692-df42d896a102", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eb86116-f800-486b-aee7-aaf8b19a9826", "sighting_of_ref": "indicator--0a453170-98d2-4aca-a8b4-5b08c09c5a5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8bc5166-3833-4e81-ac14-9e350168c050", "sighting_of_ref": "indicator--b51598f2-2595-40f1-a7ec-171b3d076e96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f03ada5-d202-413e-8385-488339266749", "sighting_of_ref": "indicator--c8650972-935e-4cb1-bc57-cf95c7ab8e2e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83fbd14c-0a91-41b3-9a58-1944e99da4cd", "sighting_of_ref": "indicator--e6d6b7f0-1e26-48c5-8c3e-ed8a2a2f499c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72726c9b-4340-4b7a-adf0-0689c2af1b21", "sighting_of_ref": "indicator--eb5dc126-aadd-4eb0-9007-18269d7cfa92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fac2fb5-262b-4c27-8dc1-7bd5be49ef38", "sighting_of_ref": "indicator--1c8056cf-f11d-4945-a2a2-55f76f1df9c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3457305c-5155-4287-8485-93947c0a2b42", "sighting_of_ref": "indicator--4b50853d-5fe1-45b0-8c67-c69a659bc1a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9e47d2-7c12-4098-9151-b290d854bd51", "sighting_of_ref": "indicator--f9592ae1-4164-4548-8f20-53b154a15cb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f36f485-c242-4848-937a-60a79ef4fd28", "sighting_of_ref": "indicator--dfe697df-66cc-4cba-bb8a-a91f4c534da0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27efe84d-cad3-498e-9c3f-e123832d19ba", "sighting_of_ref": "indicator--66f2c985-1d1e-45ae-988b-c6912ed7dcb6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbf31373-dcf7-4f0c-9d19-b98cf0568544", "sighting_of_ref": "indicator--9b4164dd-c488-458b-98e8-fd4d34078912", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c80d180-c3c6-4cc4-8e0c-a9462c0a58e0", "sighting_of_ref": "indicator--3d84b5c1-fa5d-4fa7-bdbe-e72fc834bca8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9135bc47-cdd5-4d99-8d7d-4525ff8dab51", "sighting_of_ref": "indicator--e8585ad0-8164-4660-9266-fd10ff6af02a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f57eed9a-c179-4870-a096-5d13215983c2", "sighting_of_ref": "indicator--a030a0f1-64a9-4df2-a18b-10e4e05d0660", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dd5fbad-ca02-49ce-8dcd-f3ad04399b6f", "sighting_of_ref": "indicator--e012afc7-193c-4567-920d-e376e96e5b31", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c709eab-c0fd-432b-b606-9a2dc7419d9f", "sighting_of_ref": "indicator--7be03108-ff47-4e9b-817c-7e18c846847e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d427912-9ca2-4095-80c9-95f6c658f79a", "sighting_of_ref": "indicator--652083f9-dac8-4af6-8030-ade2a716884d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a81e189-b0a6-432e-9b4c-c01030521164", "sighting_of_ref": "indicator--4df3e7d8-c580-410b-bb2c-a7713d6b698e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--465b2e04-2ddf-4dcc-91d3-b2c06dfe1b4c", "sighting_of_ref": "indicator--154ca367-88c8-436e-9c1d-b2ae194a9041", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e542571a-dc77-437a-98fa-200decb2cc1c", "sighting_of_ref": "indicator--4ffdb528-0cce-433e-82aa-85c711f6f7ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff49f90-e284-4a93-a66e-15c4b21ed551", "sighting_of_ref": "indicator--6c1a3226-48c5-4e29-ba6d-134ffe21a3aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efd3da3c-141a-463d-88a3-aea55934abbd", "sighting_of_ref": "indicator--e499bd2c-0434-4796-9a79-15003f943e21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2eff556-5f72-479c-9f92-af319b443385", "sighting_of_ref": "indicator--a08f8925-ffa3-4402-8683-369ee3d4e8a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c28f7fc-c2dd-4c77-af64-35bc6f475af4", "sighting_of_ref": "indicator--25293030-4a16-472a-aa35-3c22a5127e5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--687c2d2e-b744-4652-bc36-f4e75d44b81d", "sighting_of_ref": "indicator--92ae9d98-afd4-4a92-bb24-db9ab531619f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e7b0f23-7368-4813-826d-a82ee4c61fa9", "sighting_of_ref": "indicator--cc716c75-f37f-44c9-b9e9-f86b8d7b063e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--144bc6c0-c9c7-4fc4-b31e-9d3e79cf6d23", "sighting_of_ref": "indicator--237a3346-a17a-4c0a-af69-f1221a18e027", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc5387cf-8f14-4860-8c4b-68084848ba55", "sighting_of_ref": "indicator--f8ee2e5f-213f-494b-b547-877d5120ae96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5def5c44-be4d-4053-8484-3edb79cc3f31", "sighting_of_ref": "indicator--150ff082-8feb-4bba-8ba8-cfe2ac0b081c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a1a7595-7901-4819-a282-db5fecec6a01", "sighting_of_ref": "indicator--663e2daa-51f8-4d69-afdd-8b21d6cab6da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc44a3d7-730a-40d5-a91b-ca75b9f8dca4", "sighting_of_ref": "indicator--e0ad2f78-7842-44ce-a93d-a00456a51a17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d23bc91f-6a89-4800-a0be-2601294b23b0", "sighting_of_ref": "indicator--540bf710-86ab-4223-8d32-1b0955edb0f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4f7d8c2-0d0c-4970-98f8-22e5bd82d89e", "sighting_of_ref": "indicator--d7017d33-1b59-4e16-abde-902d5fa2d29e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1207f960-f8e5-4eff-b338-f35a6a603000", "sighting_of_ref": "indicator--54c0bf54-df96-4f07-8966-8058291383c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66010dde-8090-48d8-8a9f-583da64d86fb", "sighting_of_ref": "indicator--6ce1c9c3-5d5c-4461-9002-7a43f12dee14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5bc8884-0153-4b66-8087-b94d699873ba", "sighting_of_ref": "indicator--b40d8931-1133-419e-b9c4-cec9d240f975", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e58c759-be4d-4fbb-b3f8-6059ad3d9643", "sighting_of_ref": "indicator--7ebe587c-5086-4caa-a0f2-7e90baa04245", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b628e1c-83fc-4569-b410-aff76b566d9c", "sighting_of_ref": "indicator--d3ca2907-13d8-449b-a7c5-ba2b13de8c7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2f0b3d3-aa42-4837-8fe5-16d78e54e7ad", "sighting_of_ref": "indicator--ceb0d4b1-7f24-4559-8d44-7223332c835c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a9d6749-fa7b-4b1e-8331-d3cb50a5583f", "sighting_of_ref": "indicator--77a978eb-07bb-4f3e-ab94-395feeaadb74", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baccf2f2-a10f-41b0-96ea-68ee974ae658", "sighting_of_ref": "indicator--a46d5266-63f5-4841-822c-5c0739d7d2b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48bd315-c67f-4507-90c4-c184f7adb37b", "sighting_of_ref": "indicator--870197ac-8972-4d68-9aef-95b7ef5b4006", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--083c0fbc-b497-49d2-875f-eb504ac4d915", "sighting_of_ref": "indicator--42b43bd5-4354-4de8-9f27-bc068c645141", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--168a9c78-6b5c-4bd6-83b4-24f3d53e84ef", "sighting_of_ref": "indicator--ffaf0c6e-b282-4875-8e3f-6e95b50bdfea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e59596f-42af-474f-a058-c16026c917b3", "sighting_of_ref": "indicator--86ad6d40-58a4-4d16-961c-17e704f38f14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--901d6757-c9b3-42f5-8309-9247cab62811", "sighting_of_ref": "indicator--6077d32e-fe47-4e0a-8504-a2ff92157105", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5074bd-d8a2-473a-899f-f1dd0817f01b", "sighting_of_ref": "indicator--880f6761-c0ec-4def-80b9-3fbb44a0d19f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e85acea-d554-4e60-80bc-7f4955b86ac7", "sighting_of_ref": "indicator--d1a6b0b5-f829-4e45-9c1e-d1599fc77501", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d618911-43e2-4305-bf15-a2ce4221ed1c", "sighting_of_ref": "indicator--79eac7a1-ba52-4a0a-b084-37cf48f345d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c00ed102-01d5-4e01-a265-8bb6ebf9818e", "sighting_of_ref": "indicator--e951a390-01b8-4edd-896b-df2da9deb399", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fcfb7e-aa8f-4a8e-9053-9b666c8ae63e", "sighting_of_ref": "indicator--88d0b1aa-c1df-4aca-9602-5fec4275f96e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5023fd0f-efe7-4604-ac51-3242bdb6bfcd", "sighting_of_ref": "indicator--ba4552a4-6d63-4421-8faf-27dfd95d3841", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7a2c32d-4eca-4531-9be6-1fe6e467dcbf", "sighting_of_ref": "indicator--2c5e6f7e-183b-4239-a443-7325073435b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9ecd690-2992-4ea3-bc01-18f0d8cfb028", "sighting_of_ref": "indicator--88783a85-6ccd-4ff3-beb4-f52c1e3e361a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b94bb63-3b9d-40e4-828b-c1c92edc7094", "sighting_of_ref": "indicator--0b48554d-f522-454f-9cee-a79a0ff43b7f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a181397e-9df3-4a97-a8d2-0c6ff187d5a3", "sighting_of_ref": "indicator--fbc20256-9f3d-46e7-b6e2-65134c631163", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53179e8-f54f-4de4-901b-8628259da422", "sighting_of_ref": "indicator--28f405a0-326f-4ec7-a79c-7b485bd84461", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2301f43-393e-4728-8e2c-171017ad3065", "sighting_of_ref": "indicator--d356f3b8-2da3-4a13-ae4d-9f0b2f138dcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9005b81-457e-4189-862b-24651ce7705f", "sighting_of_ref": "indicator--e383c3e7-b8da-4c8c-8eef-6a8ddc1c768e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f034d44b-794f-4cec-8759-94b227addc46", "sighting_of_ref": "indicator--18961c88-dd47-446d-8c4c-d2590c0702ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ecb165-3af6-4708-a536-5042e8cd0a58", "sighting_of_ref": "indicator--083bb99d-f958-48b7-9d30-ff0a1d9a7e30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e4a072-c85b-4326-8d71-0415d2e13e72", "sighting_of_ref": "indicator--14e01fb5-755a-4adc-9afc-2d1fd71688d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22ec90fb-c16e-4577-8733-6a86fc3af359", "sighting_of_ref": "indicator--dc7756f8-9202-42ca-8641-d68513c42ef7", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dce3b85-7bea-486c-87c9-89e49fad2910", "sighting_of_ref": "indicator--64dd5c84-7c91-4893-bfa7-94ec789990d4", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeb52c76-472e-479b-b513-74986ea0ee50", "sighting_of_ref": "indicator--d7c97809-a320-4484-b1d4-8a1850ae6d5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--407f55e9-8672-4cfd-9f42-78de360e0ca9", "sighting_of_ref": "indicator--04b33f67-b4fe-484c-93d5-66d90992da38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d751290-50f9-4232-8d27-0badd958a538", "sighting_of_ref": "indicator--b468ec6b-3609-4abd-9ea9-eb7c7ca9455f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d48db3f-0771-4408-918e-436f0747ea91", "sighting_of_ref": "indicator--c053427c-36f2-4560-af8d-65424568d5e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fc760c-bee2-4262-b1b7-4a507502c0e0", "sighting_of_ref": "indicator--0900ded3-c692-48cf-aa30-78c13e68edda", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60cf9dd-9a22-43cd-8e2c-ee9dd41dd122", "sighting_of_ref": "indicator--5b2d4ce9-19ae-4ef5-b996-c8981e49b6de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dc84bbe-c15c-4427-81be-d0292944e49d", "sighting_of_ref": "indicator--cdd7f15b-b1df-4287-875d-b3e765c76b4c", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ac770e5-2ce0-4638-acf5-7cdf3eb2e6f7", "sighting_of_ref": "indicator--4aa45ea9-1302-471f-9d0a-19a098b11686", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e388cddc-bb82-4338-b3b0-48ac723edbc8", "sighting_of_ref": "indicator--de15b6bf-d96d-44bd-bb96-e323655531aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af09b3a6-3d53-424d-ba6d-d236b2b34204", "sighting_of_ref": "indicator--ac67d4e2-947e-43bc-8e1f-898150127b90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5efde2-7fb2-43d2-85a2-d710d31cd7c1", "sighting_of_ref": "indicator--1fbf6fda-f346-48b7-a307-26500fe28552", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7556fbf1-a32c-45d0-8672-44e78912eeda", "sighting_of_ref": "indicator--0100705a-a4ea-46b1-bff2-6740491dfbcd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--263ed5ae-0b21-4cd2-86ae-40d1e1069dec", "sighting_of_ref": "indicator--2e6e57b8-d523-4567-abf1-634e1790685f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44a35b42-539b-4b64-a25a-5620209fafc9", "sighting_of_ref": "indicator--86c0fcf0-9f27-452e-9c65-ec5cd395df93", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4578373-54c1-4903-a10e-b06dff174319", "sighting_of_ref": "indicator--d9e2fb33-8bb0-43f1-be15-66d9fd9bdf21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19dc78f4-072c-40fa-81fb-d6eb3f7a39d8", "sighting_of_ref": "indicator--8e8b5b44-b0fe-471c-982e-e08c07139260", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71679248-e9d3-4a0e-be77-bdc4919f70a3", "sighting_of_ref": "indicator--1052c418-80df-4288-b9b3-8c6df41a4d82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7cdf879-3160-4741-80ac-5dbfa956f86b", "sighting_of_ref": "indicator--8b5c25af-cf10-4eaf-822c-b812c722dfc6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97d10fed-6a42-4ae3-82b4-681202a2831b", "sighting_of_ref": "indicator--abe62d42-1418-4356-9b26-a22800e8403a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5af0d09a-3768-4b77-bc82-c726e5b0d787", "sighting_of_ref": "indicator--351e2775-b9cf-4d15-870a-1c48674fd459", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b119aa14-1ea6-474c-80d1-56289e4029f9", "sighting_of_ref": "indicator--ce360819-04c6-4e92-b023-f4841ed6d96a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a76e5a5-5b1b-4786-bb03-e55a7e7d73cd", "sighting_of_ref": "indicator--d3235a43-62ab-4355-ab2c-585db0eb603f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecd7ae82-8e42-4493-8055-8120d8a25db5", "sighting_of_ref": "indicator--2a8667fe-2e3d-46c4-ab4b-d32dec6350ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a21b28f-fa3f-4b28-b4db-97261a67fcf2", "sighting_of_ref": "indicator--2d80b085-8f08-41f2-acd8-eb3daf9db626", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef39d428-5590-4482-bd1c-67fd0f82c416", "sighting_of_ref": "indicator--06dfb58e-7114-47a0-87a5-459c8cbb4e7f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4736b320-4b36-4b7f-8225-8f036f6b25a4", "sighting_of_ref": "indicator--41773e79-8e82-44cc-b5fe-96bb145463e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7370102-2498-40ec-bba7-acb7fc015b52", "sighting_of_ref": "indicator--de0bf2a2-6750-4ef1-b392-94ac965acd95", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4810d66e-7c1f-4e54-87bf-a1cc4731b6f0", "sighting_of_ref": "indicator--f5776e76-834c-4017-b125-c8b5874e6b17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86769ad6-7646-49d1-a9e7-e020bc42e053", "sighting_of_ref": "indicator--7da6bbb2-117c-4645-94d7-b4b5163674b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14cb1a3b-f0ac-48dd-8f7d-8e4ee31eb3e6", "sighting_of_ref": "indicator--1a59866e-4dee-4e4c-84ba-d1d9dca7c857", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02a04f04-efce-43e8-9de5-4dc6bf0e7343", "sighting_of_ref": "indicator--930d936e-6c28-45c1-83e4-53259ec427f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b99b51-fc36-4d2a-b6d0-80c73a359974", "sighting_of_ref": "indicator--ac14a3fe-d3de-4d49-a8d8-ce01059eb3ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f5cb8ca-2340-466a-a709-02fb3a45c891", "sighting_of_ref": "indicator--ceb153bd-80a0-473f-a7c5-bf1b50e24dd0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f60de819-fecc-49bf-abe5-2c090a51b287", "sighting_of_ref": "indicator--91dfc715-062b-4c14-889d-f98ebb1cdb20", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ffca2cf-a769-488f-8ec2-88d68cc185f6", "sighting_of_ref": "indicator--a3c756ee-62c7-4181-8d7d-f057a55b4744", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--753b006a-ce84-43ac-903e-04dbf20a99ed", "sighting_of_ref": "indicator--0597a6fc-3044-4be0-9098-2a1f5dc4a34d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e31a783b-7fe1-4282-9893-73bd7efb8fcf", "sighting_of_ref": "indicator--e2d1e053-b770-4b5f-98b9-628fe23a2b57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa539808-b308-4205-87d2-f445708c88a4", "sighting_of_ref": "indicator--64554e61-ff03-474b-9613-0d26f113287c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc8e5960-ccc5-410b-b264-6e6f4576632a", "sighting_of_ref": "indicator--75fa72c6-488b-42c5-9c77-09db3160acf5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--949f42a4-1716-445e-a452-46fe10fdb1f1", "sighting_of_ref": "indicator--04259bb9-9416-4305-8cc8-44f598c11ab0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7945989a-8c94-4082-b032-a748cca0d482", "sighting_of_ref": "indicator--b5ea199b-c21d-4b5b-a98c-c821ee2d2022", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--811d0e3e-0f6d-4545-bb58-d366da762baa", "sighting_of_ref": "indicator--8e2aed3e-de1c-4d82-b2d1-9e94c28991b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f2023e8-7569-4a60-957f-6df5aa5256a6", "sighting_of_ref": "indicator--1eddce51-26c0-4fc4-bdd2-0f9bc6747a82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3677e3f6-6b3c-46b9-ad6d-436dfefe1153", "sighting_of_ref": "indicator--a7c52196-2329-403e-af4a-ca581d234166", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1f226c-e27d-4d52-a08c-619440f8a7dd", "sighting_of_ref": "indicator--badb0e06-0295-4b1b-9105-b551cef8aad9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ad84ea-57a4-42e8-9628-609ab18b78f4", "sighting_of_ref": "indicator--d981b6f8-5f80-4fc2-938d-9c87dd0bd800", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1df937-5a51-4478-bd40-6dec7c19247c", "sighting_of_ref": "indicator--d4cb1d7d-198b-4f4f-abe6-edc61fa4fda1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--168582c1-cdcc-476e-9b8a-23422eb45a53", "sighting_of_ref": "indicator--c79d51e8-0e4d-4ae8-91a9-b1add5c19dad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d6f9fc-076b-48f5-a864-b5b7ebdd1fa7", "sighting_of_ref": "indicator--966e59b5-3e59-4ad9-93a5-31d11b90bd9e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d5762d3-813b-4006-b806-5d17dd03a7d9", "sighting_of_ref": "indicator--3dc08c62-8ba8-4c6f-98a8-efbbf574991e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9155cf8b-dea8-41e1-a435-639f66edaeb5", "sighting_of_ref": "indicator--617f5bb2-5f36-4e8d-a44b-3aecede18366", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26172d2d-f09a-4522-afbd-3dfc2e90a98c", "sighting_of_ref": "indicator--c19d8ab7-30cc-4d17-8f9e-3577b0805df0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb2d0c7-4568-4aa0-83c8-fb9917343e9d", "sighting_of_ref": "indicator--ddbd7648-60bb-4200-86df-60e864deaaf9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48945301-95f0-4b7b-9e42-bc7e8308946d", "sighting_of_ref": "indicator--e4d57b3c-6ea0-4d70-95e9-1dd1948f8542", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266b67ec-343e-429a-818e-f20ece70d02f", "sighting_of_ref": "indicator--4fb1d5a6-f13c-4858-9a69-593d773467fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1352771f-1e5e-40b1-b2e1-4f0be050ef90", "sighting_of_ref": "indicator--6e720ff3-a319-4b24-ab01-82c3dc826eb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c230d5a-f941-4a37-902e-15b529383fca", "sighting_of_ref": "indicator--f7af1d56-b74b-4e4d-9e14-1c1c65c2790a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b59f9c-c92d-466f-bde9-cde8be22628c", "sighting_of_ref": "indicator--9c667ac8-40e5-45db-90a7-8e06e3f8448b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4566a359-1fac-4940-86b3-8c9e1f56cea1", "sighting_of_ref": "indicator--77de0601-6be0-49dd-99ab-cbbaf6475e90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c0319c-7bb1-4596-82f0-ac1e34c4bc01", "sighting_of_ref": "indicator--ec86327e-83d0-4e0b-bda5-d9bab7128665", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b69a00-58c6-4c72-957c-3c937271627b", "sighting_of_ref": "indicator--dd912743-6b77-406c-9fa6-d213ba0b0255", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66208ae3-e22d-4d67-923a-d964ca81f784", "sighting_of_ref": "indicator--b56c10df-b33f-4064-b8a6-dd9dcfa33290", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06af59bc-e6e8-4504-9385-af20017a54a5", "sighting_of_ref": "indicator--237ee9a8-7b7b-4c27-9f9d-1f32ec457593", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e5f431-bc14-4e5c-b921-31dc4681a54d", "sighting_of_ref": "indicator--5ea2127e-968a-4dce-b526-271b62aa51e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6d22e80-0acf-4b0f-8121-255d86ac0c8e", "sighting_of_ref": "indicator--34670e31-c629-4baa-921c-19d8de703acf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a94204c-94a2-473c-bbd0-62b2dbc0cb20", "sighting_of_ref": "indicator--df41161b-7515-4e71-9f15-cb115b5dcf50", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eb44a57-2cdd-4a68-8779-5221510f6c08", "sighting_of_ref": "indicator--71351c83-3a61-4f71-b28a-2f6714e1e73e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d537493-7107-4f82-9072-269c58ec59a4", "sighting_of_ref": "indicator--223f8cf6-d75c-450f-9b60-a5d1b81d8a75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37e824c-769a-42e7-afa4-796e8a794642", "sighting_of_ref": "indicator--a36ab0f6-5c40-4668-8572-96f2411e6451", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6866d810-4bbd-4a46-bbc0-f53c3f8e1f09", "sighting_of_ref": "indicator--8f76f9a5-6a86-4c6b-b6a5-8f9f0bdb61b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4e57550-2724-4dbf-8ae5-45e23f525e28", "sighting_of_ref": "indicator--f5245ae9-4ef7-4615-9af0-0413d8f65cd4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8deafe41-da28-4efc-8735-4c7322484f6f", "sighting_of_ref": "indicator--e43c28a5-3d54-4002-b651-cacfbb971842", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--676992e3-ebb9-43f9-b005-f6955c0eab43", "sighting_of_ref": "indicator--eccb9cb8-61e6-48ad-a2ab-72b7969447ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e322f734-7fee-443b-9d36-4109e98653dc", "sighting_of_ref": "indicator--c6925427-8064-4f5b-a4d7-bad2d8b838cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91572e93-fbae-42e7-bbbe-98ae70bc40bb", "sighting_of_ref": "indicator--dd0da2cd-fd00-4a76-a4e8-c0395669317d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dd6e1eb-2611-436b-b09e-c068ca34d8ca", "sighting_of_ref": "indicator--40826c5e-c5c2-4c9a-a763-7c3b891d6a0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4af67989-1858-4692-a0d2-fadf9db9d0e4", "sighting_of_ref": "indicator--666e5648-a384-4c81-93d9-54566fe2e588", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a99ec8f4-1d34-4351-a040-42c43bd94f40", "sighting_of_ref": "indicator--e95d6ea5-d5dd-44e9-a3c2-db2abad9138f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e93b38f7-3c6e-4274-9b88-17662b69254e", "sighting_of_ref": "indicator--6be7bab2-c640-4adf-9828-37288cb16fbf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5c0ec86-5781-41f6-8bef-8d4de5d7fcab", "sighting_of_ref": "indicator--c58b19f5-48c6-4917-9fe5-6071d7d1df00", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34c2b1e1-b6e7-4e3f-976f-3ecb7cbd2cdd", "sighting_of_ref": "indicator--be26cda1-4027-4b4d-b5a5-9ddf6f984087", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28082853-4c35-4a27-bc40-1091867aeceb", "sighting_of_ref": "indicator--d531cb6a-8ae2-488c-bb1e-bd6df5f00d82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74369cd9-469a-4c5c-ae92-ae50fd658d7f", "sighting_of_ref": "indicator--f0866edb-0fc9-4834-8b02-5c5eb0d7a21b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--470bd9c0-4222-4a40-ad5c-3f27689d57f1", "sighting_of_ref": "indicator--5ff57ad3-de5d-442b-8493-198144d7f327", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c07a67a6-a15b-4231-ab67-855bccb1f75e", "sighting_of_ref": "indicator--9b364d36-ad50-4ac1-b8db-d2d99a91073a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a11164-0299-44b0-a9c4-aacf5347a9cc", "sighting_of_ref": "indicator--d2bc302d-2c63-467d-ad8f-65440d45f3d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab61f26d-aa2f-4584-80bf-00f06e638245", "sighting_of_ref": "indicator--606d81d8-a5d5-446d-8f1c-dd9873be2aa4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7128061e-76e5-4280-8ef9-c2183fdcbc73", "sighting_of_ref": "indicator--4e3edc78-ce68-4ad5-a9c9-f57934c05bb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--693271a5-663b-41c9-bde1-2a0eeca2cb9d", "sighting_of_ref": "indicator--fe53f201-6633-48cd-860a-3449bc36a5e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc769878-1697-4b40-b337-1e057a8f274a", "sighting_of_ref": "indicator--5ade7a7c-d22d-4582-9d9e-b4b6e70517a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53008b51-5442-4fad-8f5b-a806586d7326", "sighting_of_ref": "indicator--b928a428-02d8-41cb-9cd2-b6ef357838fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b50d4f4a-544b-4dfa-abda-8549139cd39d", "sighting_of_ref": "indicator--71fb9b8c-0f2a-4347-b9f1-2dc791d7e56e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ff3224-4c66-41c7-a8e0-2f9884d1e256", "sighting_of_ref": "indicator--f3f7fd5b-9faa-4611-8463-1d88978afcd0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3693ca44-0349-4472-b73e-aa93a1cbd412", "sighting_of_ref": "indicator--50cf1665-fce6-436a-a8c9-3717993c2a53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa547932-5481-43da-bad7-a59c7a9dacc4", "sighting_of_ref": "indicator--231ceb9b-1733-4ad5-9393-1025dbd7fb9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--134b12ae-0f2c-4448-a241-e769c1126449", "sighting_of_ref": "indicator--4094eed4-4602-4c58-bdbf-f518ecb05d00", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc1963d-e229-40a7-b1b8-8087d24aa2b5", "sighting_of_ref": "indicator--40c1d098-c082-4fa1-9709-205839c75bfb", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a547857d-cace-437f-889d-94ae5489b1a1", "sighting_of_ref": "indicator--68ab105f-5d9a-4aa7-b835-286c1d55b7d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f61da82-8ebc-4f01-ba5d-452537c207b2", "sighting_of_ref": "indicator--aa29200b-9dbd-4ccd-ade1-8be2cea3dbfa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faaaf7e6-f285-4049-8fa3-3f44b70b1c10", "sighting_of_ref": "indicator--c9397637-a2c6-47f6-8681-054653b6f2f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09a27ed6-e41b-4be5-852b-b48599a80bf0", "sighting_of_ref": "indicator--0c786903-4acc-4a24-bb7f-2c573e64be2d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e3685a8-b609-405a-a372-c203058baf00", "sighting_of_ref": "indicator--d92337ce-b637-4844-b151-95de10df6b6d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67101073-e7dd-4710-9a68-e549cfb29b49", "sighting_of_ref": "indicator--5623dcf0-f102-4376-a385-d11d075a69eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2004e93-c4ba-46df-a41c-1194a2904190", "sighting_of_ref": "indicator--75e65c43-d16a-4cf5-a205-ff821cf8bc10", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44e1af95-5649-4977-a813-4605c22bc627", "sighting_of_ref": "indicator--034332f4-4f30-4de7-b0c8-019458352228", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21c5e7b8-17c3-49ac-9744-ad9e1bad202d", "sighting_of_ref": "indicator--1255f13a-243b-4cd3-8c1e-6d6d6b466fb2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32336c59-318a-4089-8b2e-dd3bd48a99f2", "sighting_of_ref": "indicator--df32fa4e-1014-45da-a784-f27d6e33d416", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9e49a4d-b3de-498e-93e5-48bc1db07f4d", "sighting_of_ref": "indicator--ec1d6e11-7fdd-4615-8b69-3cf477340e8d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7dcbf65-eb29-475e-aca8-c86c8d3ce64e", "sighting_of_ref": "indicator--8e952fa7-44fb-4066-9ba1-bbf214f14405", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c980936-0955-4096-a4a6-569ed9d82177", "sighting_of_ref": "indicator--0229aed7-b594-44e0-b026-c3ae403e8376", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8676ea16-76cb-4904-8fd8-b7c15a94ddf0", "sighting_of_ref": "indicator--ba909efd-4896-425d-b27b-1409a8bb66ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c9d37e-81c9-44c3-8618-4f7ec9be719a", "sighting_of_ref": "indicator--fe10a6ff-8d43-48f4-9d38-f29be5eb8905", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af4a9ee6-7e5f-437c-9191-c66a0d5d7afc", "sighting_of_ref": "indicator--ab34476b-784b-4bcf-953c-1e1fc2422963", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9dfd1635-6221-4f6c-b359-8abb440abb98", "sighting_of_ref": "indicator--ff7d98e7-abfc-43a1-98d0-b1569d728609", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c5ffc01-9946-4f5f-b8e2-16ef6b2f88e7", "sighting_of_ref": "indicator--888a3c1a-72e9-4d15-8e31-deca0147b37c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d3c40bb-a0d7-4db5-b821-2dcc52913b1d", "sighting_of_ref": "indicator--f386f8ea-503c-4ca2-b486-1e3903d8d1dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ddfb8b-3d1a-404b-bce6-8d611bf2723e", "sighting_of_ref": "indicator--836c7dfc-d585-469f-a12b-c0aff6254343", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--629d39ea-75b6-4a30-8402-94e0061a402a", "sighting_of_ref": "indicator--efc6fe93-d601-45b0-bec7-ea9eae92a8be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d365183d-d172-404d-8250-5257e8e82f7a", "sighting_of_ref": "indicator--424c9c2e-846e-46f4-8fd6-7ec32dc8d638", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e46c6801-653a-4ebb-8f4f-f190833e8876", "sighting_of_ref": "indicator--401df100-7776-46b0-8d69-63e47bb54036", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--544bd592-a624-4725-9af6-9e9240646cdf", "sighting_of_ref": "indicator--5ae92291-ceff-49e2-ae46-1707f43981be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89867a8b-b2fb-422f-941f-99237d1717ea", "sighting_of_ref": "indicator--1f8ca3dd-06b2-45e8-8d8d-f5eadf0c33ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb0fadb2-13ea-4981-9131-984c13fb7444", "sighting_of_ref": "indicator--2dbd62c4-2637-4d79-9af0-7da2e6cdfd17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ae1ec4d-75a3-4bd4-8a2a-12876e101ce7", "sighting_of_ref": "indicator--db40b8e3-cd2a-4c1c-9c6a-db5b35b63a9d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e6a1e9b-ee34-42c1-b8a1-4f3c9a1d2a5b", "sighting_of_ref": "indicator--b9a1db5a-97ba-4d45-8d96-23b16d5c5af8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3249f6b-ddb9-41f9-b26c-7da42edcb65d", "sighting_of_ref": "indicator--71e6189f-8d51-4031-bff2-898422d24fa5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ec11728-cb3f-4b5a-b10f-68b9296712b4", "sighting_of_ref": "indicator--66036ecf-1c8c-4a48-830f-60b57052ff5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60a4e5d3-6f8b-40c2-b7fa-f66daabaa350", "sighting_of_ref": "indicator--089bc2d7-6edf-4b3f-9d28-6be49adf7dcb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1df3e7ad-1629-45bf-adcf-de26e2b36e2f", "sighting_of_ref": "indicator--55930089-7922-4d5c-bdae-db278a1e0199", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d86d47-f39a-44ef-a543-26aaba4374c6", "sighting_of_ref": "indicator--972c68ef-05b6-4118-ba19-f0c4df5fad1f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aeb1368-5e67-4e62-9e05-aa98f4176b7b", "sighting_of_ref": "indicator--7172e9ec-1563-4fa3-b9be-d82c1ed91b2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32fdf55a-4925-4229-af7d-5cc5d2bfc653", "sighting_of_ref": "indicator--eb27f519-6828-4fd4-bce5-abda7537d1a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cdde3a9-c9af-4165-bfc3-2b3cb7981b1d", "sighting_of_ref": "indicator--75daabeb-5fb0-40d5-b01a-d961ace43430", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88a8c1f7-500d-48b7-bf6f-658da084f486", "sighting_of_ref": "indicator--91638980-20d0-4cde-b706-aab85e9ae025", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a509c83-9c1a-486e-a066-9648c203f9a5", "sighting_of_ref": "indicator--412a3454-25f9-4df2-ba00-fba054b15edb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b1dd478-2d2b-4bc8-9f90-6375f22d6cf6", "sighting_of_ref": "indicator--cfc72542-5613-46cf-9454-310e43020bcb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--333150d6-6eba-4865-ae64-1c7ce5961321", "sighting_of_ref": "indicator--1f72db29-8479-47e7-a9a2-c76c6ec9a4b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0065e9d8-78eb-4e01-bdec-74860c9558e5", "sighting_of_ref": "indicator--1f72db29-8479-47e7-a9a2-c76c6ec9a4b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1982a138-0d09-4c4a-be38-a6e7d871fee1", "sighting_of_ref": "indicator--b2cbf171-2201-46e6-bc76-e3192355a98b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--566dc74b-3e03-48d1-bc82-5bb838ba7ca5", "sighting_of_ref": "indicator--2e870b9e-b19d-4f49-99ae-f5f2a8ebd065", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4628b68a-2838-4c3a-ac7c-ed1040fb63c9", "sighting_of_ref": "indicator--a2b9a12e-3247-4e9b-b52a-5e99f320e401", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef90456-dec7-45a9-b32e-05faa41b1d2a", "sighting_of_ref": "indicator--2cf3c82b-87a6-439f-bd44-521268adf9f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9669e22a-9b10-42d8-97f0-b43d173d5e40", "sighting_of_ref": "indicator--4b3f5ee5-06d7-49d2-b97e-111665074573", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44ea0eb-e232-499f-82b2-52b33c308ed9", "sighting_of_ref": "indicator--92f8af2f-3661-4bec-9ee3-27d3f41cf9ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a32a8bf-8168-426b-b964-0c24e3c26451", "sighting_of_ref": "indicator--565a5456-e4f5-4b98-ac26-54b9410638f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04516806-bcc4-4996-95f5-a4ea42b9e7fe", "sighting_of_ref": "indicator--36f2600b-c468-4582-b316-37b5a7c3e1bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afdfc9a8-9eaf-4312-97e8-6ecb06746ff0", "sighting_of_ref": "indicator--b825999e-ee8b-4176-9250-b3084fbcee97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b5154e9-8544-4dea-950d-a846e3b47972", "sighting_of_ref": "indicator--2debb39c-2c50-4d1d-b01f-ea966f103d15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e757b4-9029-4215-a5d2-16acd8c934c3", "sighting_of_ref": "indicator--7491923b-e00b-48f2-a30e-fcc91d9e87b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270fac43-1481-4f51-aad1-4839eb8863ea", "sighting_of_ref": "indicator--f7f6811b-d897-4899-b88c-dabebab25dd5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6deb9c5f-a6c4-4c57-99b3-e215ec563a14", "sighting_of_ref": "indicator--3155e30f-524f-4499-a520-286644357cd3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f033ee-bb5f-4dfe-b7ed-77838fd682de", "sighting_of_ref": "indicator--b900e6a7-342b-4950-83a8-5306da407180", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--829c9cd8-0c4c-4000-a959-efa8971ca4bf", "sighting_of_ref": "indicator--e5fbcc8b-1446-437f-aebe-0bf7896800fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a310596-abc8-4092-af00-9f023afa5012", "sighting_of_ref": "indicator--e4a41655-7105-425e-a92a-1a03dbdbcf12", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d031543-ca72-444b-acc5-a125667ab369", "sighting_of_ref": "indicator--d07cb4ea-220c-48e4-8560-f3d947134716", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abab3fa2-ba30-41cd-b85f-8a903ca2dfa9", "sighting_of_ref": "indicator--957402cf-5776-46ad-99e5-8a733c12d6a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82f0d35c-e85f-4b71-a601-a9f13893f5f9", "sighting_of_ref": "indicator--e2ec760e-9d38-4f16-a8da-f58e6418e2df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeb18275-907f-447d-a816-be39ca0c2876", "sighting_of_ref": "indicator--42f4cccb-33ba-442a-93ad-3602302fcb26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de05551-456d-4b05-8cff-79929a77db74", "sighting_of_ref": "indicator--85c4ce83-e39b-438f-84bd-172a2acb805d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65b7306f-62ba-4d3e-bb30-f5b745e4722f", "sighting_of_ref": "indicator--27f42b7f-9003-41fc-ab8a-0a0a185f9cea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d293067-4e40-4037-8cf5-fe4b527721b7", "sighting_of_ref": "indicator--6ac67bb6-a386-4efd-8551-fa7783fd62fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ecb85a8-e938-4797-8bec-a4995dc157d5", "sighting_of_ref": "indicator--157d7aaa-04ae-4780-9413-6536f882bebd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0783675c-8a35-421a-b6a8-1619bdb5e8ed", "sighting_of_ref": "indicator--288cbdb3-dbd0-450c-83e3-8ac593f04cdc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--597369b8-892a-4964-b1f1-c65a39ee7287", "sighting_of_ref": "indicator--6aa4207b-d7dd-4ced-9054-121c4b47284f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9232137b-b17d-44de-85ac-540174d9de8c", "sighting_of_ref": "indicator--5aad9438-2742-462e-89d1-68808123e0ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e197c143-1bb4-4ea1-8569-e5d7f6d7e087", "sighting_of_ref": "indicator--65372a57-35a8-499e-a1e2-69b6d4009fd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22d2a91b-cc87-4b58-aa07-f005852e037b", "sighting_of_ref": "indicator--420b71ab-2598-4bc4-8c1e-72ae7bf56a81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17612a09-78f2-40a0-93a9-3c2126cd2828", "sighting_of_ref": "indicator--b7fdf50c-1db9-4797-a748-11c2c6972c27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8751bb2-76d2-48a8-aa05-29f7403ab0a6", "sighting_of_ref": "indicator--0b59abea-ce8f-40f9-b73b-8fc380fc3589", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10a528db-bc4b-461a-a77b-59cf9c0e163d", "sighting_of_ref": "indicator--1ab3449c-104c-4e2b-be97-782004069a8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b055125-e05d-4c73-9784-1e5415da0702", "sighting_of_ref": "indicator--01a3edfb-f63a-4cd5-a807-e6016d3c61f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--834df1e6-68e4-40a6-9c27-86162019f76a", "sighting_of_ref": "indicator--645189bf-c5f9-4f99-b694-f90f4813bc36", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe189c18-bdec-4dce-853e-79a486acaa10", "sighting_of_ref": "indicator--79174605-c5fe-4a27-beca-7932d5d54ca8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131f1e60-a3b3-43ab-95fb-bd52e9ff2623", "sighting_of_ref": "indicator--ddcba2df-c8f0-4f11-80bb-4ce2a7c7d353", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8ab66c7-2efc-409e-b35a-82bd3699b3f3", "sighting_of_ref": "indicator--4fd46de6-7679-49bf-a20f-f6b2c72a9e27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60698b1b-a4f4-4ac4-8ac6-3c7bbb14745e", "sighting_of_ref": "indicator--3ec6bf35-004b-49a7-b5c0-71330ad622e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--097d59bf-35a1-4349-af56-c7913c7783a6", "sighting_of_ref": "indicator--ea5df23c-2d4e-452e-95bc-d50acd339a98", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ade943c-7b7f-4c41-a13f-7946a7430b21", "sighting_of_ref": "indicator--7701b805-5aec-4498-8619-1b091c125b87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--541a1784-a66d-4dd8-b3ba-66f55348bc59", "sighting_of_ref": "indicator--bf400f47-62e9-4e3d-ab0d-038ea04e5348", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e85e5dc-11a9-436c-b2a6-a1f5e50b8afe", "sighting_of_ref": "indicator--3918a9a4-3f1b-4b52-b414-7f3c070055a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e460d94d-5472-46bd-8e6a-986a04921220", "sighting_of_ref": "indicator--5a4e7555-f42f-4a82-8a27-d2c6e7927fba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da162f91-2d5f-48a8-ba2a-3714f7ea7511", "sighting_of_ref": "indicator--4c471487-26b4-44e5-a20f-93d3cb63b9ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dbfeb6d-30b2-4b49-aaec-52ba8b166885", "sighting_of_ref": "indicator--f7b3a148-7019-4bb4-9883-89b880680c95", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75da530a-c0bf-4007-8c17-8b35c74ab6ce", "sighting_of_ref": "indicator--a10f6d5f-4e13-4027-89c2-2ef3079fedc7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d6ea0e7-73d1-4d05-9794-cfdfded44efc", "sighting_of_ref": "indicator--38538d4c-430a-4190-961c-c51c5deccd5d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7d3c122-0cb5-453b-9da0-125cae82d09b", "sighting_of_ref": "indicator--77d0f6df-53b1-4715-bcd5-24b2dc309040", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5674026d-09c2-4ef1-8c57-5361c7333e22", "sighting_of_ref": "indicator--62f17247-289f-4b4d-9dab-4c68e0fc9beb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--689ffcab-26d1-4cdf-9019-e20268d92504", "sighting_of_ref": "indicator--e45a9bdd-c65d-427e-94d4-af9f2c88a7ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f653f41-dbab-4036-a4a7-3efb9775d29d", "sighting_of_ref": "indicator--956a40ea-fea5-4c27-917e-9f73570bb487", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0817883-e52b-4373-b81c-ea98a370df11", "sighting_of_ref": "indicator--7571d174-8264-4b53-9ce2-91f2349f191e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd239205-38a2-4d11-b1db-9cfe9b906423", "sighting_of_ref": "indicator--5a90bd0e-ca2a-47c2-a7d3-0e86d6bc310a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6236e2f-f641-4057-88fd-5cb3ed0b3166", "sighting_of_ref": "indicator--67c3a234-bf4c-4d0b-b481-266ef59abe2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd51226f-53bc-4af4-8da6-2d93f348c366", "sighting_of_ref": "indicator--e8f3aa5a-4510-40ec-b963-34ea28656a07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cd9a7fc-0b71-4a28-bcd0-dc1d2108e827", "sighting_of_ref": "indicator--c0cd18d6-712a-4157-a947-22da2ac786eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d0bd59b-d3f1-43ca-a748-a8a1345fa228", "sighting_of_ref": "indicator--581fac0b-1f67-4c7c-a2eb-9156553a7b4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bdedc52-9c67-4c04-a113-cac41b9ebf74", "sighting_of_ref": "indicator--21f6361d-aabf-431a-8b31-83c13b66c48c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e08eb8-0c66-40e4-a8ad-4078dbb2453d", "sighting_of_ref": "indicator--9b4184f2-5036-4cfe-9450-e8c8193dc522", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3de8e7e7-614f-44b7-9443-a9b53f2aacc5", "sighting_of_ref": "indicator--54800a98-5056-41c9-a0f0-3dae9194fb95", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d95270c9-3f00-4702-88d1-13e3a3d028b7", "sighting_of_ref": "indicator--a2f3ade5-1100-40a1-9bf9-02db21582f6b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc29132-1a4f-4918-973c-9f99e4657c7a", "sighting_of_ref": "indicator--bced8deb-a9eb-4a01-88fc-92961781593d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e76a56e-b125-4041-950d-2512362dcecb", "sighting_of_ref": "indicator--3e9f7b0e-0515-4b75-b000-ba8182ef81a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0bddf19-e4a5-4d81-ae06-a0ee71f57f16", "sighting_of_ref": "indicator--1c24e262-50f1-44be-b6c9-0c877641c011", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc9dc498-edf6-479e-8aaa-b442b1ebfefb", "sighting_of_ref": "indicator--d73d08f0-076f-49ff-9c0c-15226d6bf971", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2313d3cb-804f-4575-9f12-da62e0742ec9", "sighting_of_ref": "indicator--db13330c-4b43-48fa-b21f-9299d7cd416c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0748bb1d-2658-474f-b77f-54038b44f2f4", "sighting_of_ref": "indicator--95f6e3cb-c2cb-45df-92e7-577f4a301341", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1842f21d-3a0c-4a98-abc5-2adaa419a579", "sighting_of_ref": "indicator--194fb8f8-7972-4703-89c3-e03c736ef355", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36fe3fd-69f0-408d-8b5b-2af5face8150", "sighting_of_ref": "indicator--b7beba31-3a3b-4386-961d-927ee8cfa45a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6686496b-84bb-49e0-8af1-963b3bfff718", "sighting_of_ref": "indicator--b7beba31-3a3b-4386-961d-927ee8cfa45a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35f920a2-8a2e-4fc7-9074-8a88ff066b22", "sighting_of_ref": "indicator--9ebb1f42-2ea7-4468-8e37-c78b4240a9bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--702078bd-1d10-411b-93bb-6a81574e1574", "sighting_of_ref": "indicator--9ebb1f42-2ea7-4468-8e37-c78b4240a9bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8ffa786-efea-4d14-8d99-c35bae1daaa6", "sighting_of_ref": "indicator--bc97b335-9bc8-4b9f-a191-d15031e9a1c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f767494-6dac-4a4e-940b-1a73c7112af1", "sighting_of_ref": "indicator--bc97b335-9bc8-4b9f-a191-d15031e9a1c6", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d567ee-e78b-44d5-b5e5-5e645dd3435a", "sighting_of_ref": "indicator--0c1cb63e-fd6c-4314-947f-92f63c1bf724", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa001c72-d736-4e4d-82c8-8d7884db1e47", "sighting_of_ref": "indicator--297bff78-5fb5-4b45-a225-b8022125f531", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--917e745f-d8b1-4a97-b605-e5966070df8c", "sighting_of_ref": "indicator--b2973c56-0819-46c2-ac08-4899d262f22b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de3a29cd-b9ed-494a-af13-98e6944b24bd", "sighting_of_ref": "indicator--59ad29df-f1a6-4c32-b321-fb254b8c5281", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f44281e-a5e5-4917-b3ac-de37369152c5", "sighting_of_ref": "indicator--59ad29df-f1a6-4c32-b321-fb254b8c5281", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d3425e8-19d0-43bc-a788-2b8e2d346dc0", "sighting_of_ref": "indicator--882bcb40-b345-4ad7-ad2b-7a77a7044810", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e2e0d4a-0337-4cfb-8347-292768760972", "sighting_of_ref": "indicator--59f87221-0a04-454c-a485-2606e033e956", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--964e0af9-cce6-471a-ba39-83c896ef5c70", "sighting_of_ref": "indicator--ea2fb3af-ce16-4e54-87d0-fc7ae957ae85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00079394-123a-42cf-aab2-d97c8649d06a", "sighting_of_ref": "indicator--d8d4d01d-94ab-419f-a4e2-5babe89da5bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e574161d-e98b-4114-b1b3-dfeb41f54bbf", "sighting_of_ref": "indicator--df9523d0-6975-4bea-850c-40cd0fcfcd15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2136900c-efef-4437-8805-58e910720277", "sighting_of_ref": "indicator--c9805f12-9c90-4e8d-adf8-a79b88afc5f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--471980d7-b8ac-4c3e-a3f0-8eca75127c9f", "sighting_of_ref": "indicator--166406ee-a40f-4b25-857d-a7cca251312d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a459df-7571-4136-b35c-841367e0242f", "sighting_of_ref": "indicator--2af74dc4-020a-411c-8f18-f3a4a1520ae5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d979094b-1c4c-4796-a186-d81d5bc2ba02", "sighting_of_ref": "indicator--2d820c62-d9f5-406c-ade0-e0163544582a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2179eed8-10f4-4932-a1aa-865c84a79a52", "sighting_of_ref": "indicator--369f9ae5-bd6f-4d2a-b66d-b468985626d0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39ce5e2-9f8b-4530-b2d8-fea92a396190", "sighting_of_ref": "indicator--fe781673-dfd6-4a0c-88a5-3a4133dc576f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd4e80fd-4f68-4a6c-bbc7-26f2c26dd9ee", "sighting_of_ref": "indicator--a6d8431c-b93c-4517-bfc1-ba7d9190b3be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e6a4837-7d39-4cd1-9d20-62f6c2824068", "sighting_of_ref": "indicator--eb4f86a2-c3b0-4fa7-81b9-88eb40b68220", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e369cf2d-13bf-48e6-8d69-29dba02efa0a", "sighting_of_ref": "indicator--15cb93a3-5e60-4c24-86e4-aee80649e031", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8b655c9-2e7b-4ec2-a7eb-9fd42f76091b", "sighting_of_ref": "indicator--f7395d0c-fc6a-4877-878e-0e95256fdfe5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9cf5e07-79e9-4191-8b73-42a9ed3cf326", "sighting_of_ref": "indicator--b3ae8c86-ee94-4208-99de-8bd3e24128f1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a0c4ee-e7fb-4a4a-a020-ac1b765cd21f", "sighting_of_ref": "indicator--ef0c665b-dac8-4e21-87c1-9ab73858348c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d972ced7-c4a7-410e-b20e-5ca23bc30dfc", "sighting_of_ref": "indicator--9bacddf5-733d-4c80-86ce-f32591aed0eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff44ca3b-c318-418f-b598-526d5cb0d483", "sighting_of_ref": "indicator--ceb164ae-369c-4b32-8084-1df30d9d7c7c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4579f0c2-2018-4fdd-b2cc-2ccb30250862", "sighting_of_ref": "indicator--af7aca16-7844-441c-8e35-35a6bc755843", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--066680be-d6a5-407f-9501-cb09580808e7", "sighting_of_ref": "indicator--6c5d24af-dccc-4037-8212-aa136bd0ecdf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65f9c0d7-e87c-4f31-819f-ef258d772e05", "sighting_of_ref": "indicator--fa30d9bd-9a3f-4ad9-aef8-63a600d95fda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51fed6fa-46a3-45a1-beff-ac86483df2c1", "sighting_of_ref": "indicator--2b07e0fe-5df6-4109-a1bd-4cc2d088c94d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436cc87e-656b-47ee-b27a-905d91e3ce0c", "sighting_of_ref": "indicator--df3fd5b8-2d0a-41fa-a7a5-c147e0f8b6eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2239a05-4f5d-4d74-b8f8-6567e097764c", "sighting_of_ref": "indicator--cf17a6c4-db42-4964-bc1b-259d6e40f9d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4038eb3a-6690-4999-a8f4-9dfac2df0f46", "sighting_of_ref": "indicator--3c58f5c1-9ab0-4bb9-ae6c-d28c0598a85a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4e28cfb-15f3-46a6-ad74-ab3b1c120776", "sighting_of_ref": "indicator--8ed3c7bd-cad3-4ffc-b338-83e42d0b49aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d16ff102-9e3a-415a-a49b-1faf88bf8970", "sighting_of_ref": "indicator--956779c7-68ee-4265-b6cb-f71f652ec55b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1cf2e4f-d2ad-4e3a-be14-b0fcefeeda52", "sighting_of_ref": "indicator--3e367201-6de8-46bb-854e-834ff2d9e6da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88c604c8-1499-4513-9053-bd340ce99663", "sighting_of_ref": "indicator--a6c4bba9-ce47-443d-8663-d678117a6cac", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--150992e7-aecc-42b7-b454-34781dd335d7", "sighting_of_ref": "indicator--3e5b5cab-ce41-442b-9c12-35114f86073b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88678323-477d-4e1f-88ee-6f9c8a6f82c5", "sighting_of_ref": "indicator--86240db8-de21-4f29-99a5-a1728e49008a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48cb16c7-4806-45a0-8a53-d24256a131dc", "sighting_of_ref": "indicator--2a8d817b-c842-4c13-8162-ae8fba2abc21", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7610e50-f4f3-42a1-86fc-aeabf03f659b", "sighting_of_ref": "indicator--95c62bbf-462e-4f93-ac68-39d98c5dd0a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e88402d2-4287-4309-b4a1-b62d83e2df0e", "sighting_of_ref": "indicator--09e70a22-9ef1-4723-8338-4c873aeb5f30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--705b976e-25a6-4042-88d1-a6cb82b6e0c5", "sighting_of_ref": "indicator--747ef61b-b2ee-429b-a54e-06ba82485c2e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6c6fcb1-5f59-4e7a-af14-23051ac69076", "sighting_of_ref": "indicator--99dd2555-ee82-42a7-a63f-10f791b38f9f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--268e34cb-0805-485f-b6c1-2f510cb184a8", "sighting_of_ref": "indicator--7eb2f3ae-b0a2-441f-a446-6309d904fd4e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0f646c0-8aa3-4503-bbe8-a09e2d939bdb", "sighting_of_ref": "indicator--3622985d-e92f-4578-acb4-08a568d44161", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8d3aef5-f675-4ac6-9029-bdc88ede962a", "sighting_of_ref": "indicator--6f15ddf0-5f7f-4171-a798-e955d33ac40e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0de1a405-b906-4e8e-bd11-e3bf142e28cd", "sighting_of_ref": "indicator--e337304e-0534-41fc-9ea0-b79dce053486", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6806907-083b-4bb9-b6e3-9024ba15b6fd", "sighting_of_ref": "indicator--d702103b-e0a8-48fa-8258-025a0734634d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57555f81-20cd-4868-bbc9-7469001ed22e", "sighting_of_ref": "indicator--30e93e7a-96ce-4b16-a196-d465bce31b57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b79c811-d14f-40ed-a7a3-6d282d4e162c", "sighting_of_ref": "indicator--5dc12053-5d74-486f-a2f2-733b960a1e80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cca979c-58fa-45dc-ab4e-f934bf14e84d", "sighting_of_ref": "indicator--4999cbd6-da64-4609-978f-75ae20fec8a1", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04a8a0a4-f499-45f0-b687-d7b8b14bdf57", "sighting_of_ref": "indicator--ad5dfc63-0dfe-43dc-bb98-3af763f36f08", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--570697c7-38e8-4086-be96-91be2b07da8f", "sighting_of_ref": "indicator--800cabb7-326c-4b15-8714-7ea954fe045c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2c702a-8f78-42cc-8baa-680eaff7615e", "sighting_of_ref": "indicator--53481139-dc58-4e54-b95f-fdb837535cb4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--607f780d-a567-42f6-9956-7543df55b071", "sighting_of_ref": "indicator--80af3435-7416-4e37-8756-0c1206224ca0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc2a635-a39e-47be-ad3c-c0b8037fb48f", "sighting_of_ref": "indicator--55bce1ce-ee1b-4c12-9c43-88d9d5f39df2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4e320f-e139-4410-ac5e-afb4fbe6518d", "sighting_of_ref": "indicator--292e0345-3949-45ea-9de5-b9b36bde9dbd", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee495980-f2f3-4ae5-b88f-0f9759796be9", "sighting_of_ref": "indicator--157e9ff2-0e60-4981-bd0c-3a3fd89622a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96b9b40b-5f96-4885-b9ed-02539ac3b85c", "sighting_of_ref": "indicator--b1938388-cea6-4ede-8581-ce246e81423c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df203279-302b-4116-aab3-3c266f820879", "sighting_of_ref": "indicator--9817cd74-a6da-4a61-8ba6-edd341d8ecd3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c97cf76-52c1-4b50-94ea-cdf66e690614", "sighting_of_ref": "indicator--a795bef6-d4aa-437d-be31-9ecb6f691ff6", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fd51f95-9f2a-4160-8048-6b3ffc72dbee", "sighting_of_ref": "indicator--a795bef6-d4aa-437d-be31-9ecb6f691ff6", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c27a0fb3-0a13-4ea8-94f4-dbb7c11a8a3a", "sighting_of_ref": "indicator--a795bef6-d4aa-437d-be31-9ecb6f691ff6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5f169ac-d5ed-40f7-bfd6-0451a5e602cd", "sighting_of_ref": "indicator--e8d599cb-0a05-4eb3-b9aa-289a3575d594", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2806aa64-0f52-49a7-8387-8838230368e5", "sighting_of_ref": "indicator--ff72497c-90f2-4bd6-9c67-736f6495cb39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--352634f8-c5b3-4554-b322-33334af5716f", "sighting_of_ref": "indicator--ea1c84db-f301-4d84-a53a-69a47957bfd6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5bbfed-120b-4210-9cec-a8439428722e", "sighting_of_ref": "indicator--3a120582-f53d-4164-818b-25cede1544a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--374984da-594d-457e-a7dd-d7e61c2d07d3", "sighting_of_ref": "indicator--c3ada057-4201-469d-bbe9-7a1a5c8b1e3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d9a86ff-8eac-4bd1-902a-88812369affc", "sighting_of_ref": "indicator--8a79d398-b94b-4fa0-a03d-16af6a25dfa5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7343b5d7-9247-4c81-870e-10d36986058d", "sighting_of_ref": "indicator--e2c3e770-98d3-4c21-9056-c4005e52184d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a0f7fb-7044-41f5-a443-eb6a6d4c980b", "sighting_of_ref": "indicator--9fa1c308-0c0a-4cb3-a4e6-55f08b747328", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--778a6560-cdcc-4de9-8eda-6377da59c3d7", "sighting_of_ref": "indicator--1edcb7b9-68f8-44bd-8540-c519c443e5aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fce43b3-5eb5-4baf-8f86-00fe12539274", "sighting_of_ref": "indicator--bbc14b83-6c08-4915-97e8-ebb9a96791e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de7566b8-09dd-4c4f-8260-4196b00565c1", "sighting_of_ref": "indicator--7e9c1440-8e2b-4e18-9a3c-2ef789c89f1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c238a22-e3e9-4b2d-8ae5-6805071c2dd0", "sighting_of_ref": "indicator--086e9eb0-fcf4-4ff4-9af4-add503026803", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0582bd9-59e9-4a38-9727-e7171571e8d4", "sighting_of_ref": "indicator--d61dfa38-8f98-48cc-b023-d1671c823c3e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe5df24f-62be-4c69-95e8-104b0201071c", "sighting_of_ref": "indicator--c8b0c238-44ef-44ce-8af7-a8849b4a0df2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8918aa6-ebfd-4c23-9b49-b2fd42aa51af", "sighting_of_ref": "indicator--35cfc276-82a3-460a-a007-f0a6f33b02c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46f73f65-1254-42e4-b6f3-981134f6a636", "sighting_of_ref": "indicator--ec3fe23f-4956-4e36-8027-244fa5649a22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd2e53fb-12c8-4971-9476-0c12937e3392", "sighting_of_ref": "indicator--de528465-3835-4054-9114-b7671452c281", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e420c9a-b743-42cf-95cd-9869a76039f4", "sighting_of_ref": "indicator--10c20c30-f852-48e0-892f-dbedf62e3ffb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2ef62da-698f-466a-908b-29a358f75cc1", "sighting_of_ref": "indicator--78b50672-9201-44e7-b505-f8114b03f3de", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8105b042-d8e7-4a50-a4a3-a328ba96de0c", "sighting_of_ref": "indicator--1246900e-d23d-4f9c-ab68-5bcfff670701", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eebb6d0-1ceb-40b6-9ed5-5468bc3726b1", "sighting_of_ref": "indicator--770c9c2d-a1e9-4c03-9bbb-60d08d77ed32", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c14f96b-530d-47e6-ac7a-b632b67f3294", "sighting_of_ref": "indicator--504fab1a-c093-46a7-bde2-ae17a78f3164", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--520bf6cd-6f0c-4d49-aeb2-4cdda94e351b", "sighting_of_ref": "indicator--0a3d7d03-1bed-4e8f-ae61-aeb261ae59d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--840918ce-8763-42d3-b6cd-1cb200f2976f", "sighting_of_ref": "indicator--2aaa500e-9d30-4cf8-b6a3-dd9bb0606164", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ec6812-c38f-4289-815b-22b476fe1517", "sighting_of_ref": "indicator--62219d66-35ca-4cfe-a826-249c78d505ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3a8e722-65f7-4351-99bc-c22b0e15a366", "sighting_of_ref": "indicator--b4037790-d55e-4007-bf42-99c58ac4f874", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40fa8f9b-8c7b-4b2c-882c-b0c21bc4e85c", "sighting_of_ref": "indicator--85b391d3-8677-4b63-af1a-3460c4ee3c8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e638b59-c5c1-45e0-a392-01a88a251f29", "sighting_of_ref": "indicator--d85419aa-a2dc-481d-abce-0ba1a58400ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--955ba899-12ba-4b6b-ba9f-5b92c159acc0", "sighting_of_ref": "indicator--dac71e3e-c5c4-4b79-a351-73730558a211", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--249ee7f1-c785-46d4-8d31-3b258bd56cb6", "sighting_of_ref": "indicator--76343ebe-d936-43c4-b29f-25ff0291ed42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52d460c-ca3e-4a77-bb6a-24ea6cf44c91", "sighting_of_ref": "indicator--33625edb-470e-432d-8975-90123e8b76f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c3e819d-ce0b-4a92-a544-7cc481e0d29d", "sighting_of_ref": "indicator--3d9a0755-c0af-460a-8349-46e87c8a4ad6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ddda68d-8b45-442d-bbeb-dca193f07745", "sighting_of_ref": "indicator--a60c4e3e-fbc6-4e8f-8dcc-a33e5a22ad69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7db88783-64f1-4a2c-adab-fc100b1a68fb", "sighting_of_ref": "indicator--ef8977be-b333-4965-bd78-36a9450924ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd993a48-f32c-4ebd-a808-587ce7ee0fe5", "sighting_of_ref": "indicator--70ac89c2-01f5-4918-bf71-76e9900fe4fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec2ce2d-6d85-4229-8b7b-3f0e9a2d1375", "sighting_of_ref": "indicator--d5b8907c-b9dc-4911-9c99-ce46264438fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e80cea-b863-4077-9428-a629da14dcd6", "sighting_of_ref": "indicator--0b5a167c-47d9-41df-b66a-22c46091ee41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc3336ff-dcf6-4d26-852a-430ba806e307", "sighting_of_ref": "indicator--abfe56f4-db03-41d5-9d73-94ca0d25c9c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e490f7b3-1e6b-4332-8dc0-81964dc3ffc7", "sighting_of_ref": "indicator--553d7f54-df35-4474-a5f7-9310e4e5c64e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28803f85-2961-4960-9246-ca9dc93b378d", "sighting_of_ref": "indicator--3bf6339f-04c4-42c4-b52a-0120894808dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf5e74b2-738c-46ee-8254-21113a7bba03", "sighting_of_ref": "indicator--2212811a-e62c-46ed-a47b-4b1d55bf079f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138b6107-3857-4837-8a93-a8b8501a38d0", "sighting_of_ref": "indicator--8c7ee67f-40a7-440d-95be-bbed9018ebe1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47bc6833-cf63-45bb-872d-2f60712e871b", "sighting_of_ref": "indicator--d2501ab7-9214-4ea0-8faa-6304f0078cf9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c288ce6-98c1-4ca2-82c8-9bf987c24f23", "sighting_of_ref": "indicator--72c900e6-42be-43df-ade2-a9ec349977bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ce10472-674b-49b6-8dc2-b2b80d2144e3", "sighting_of_ref": "indicator--669189b6-7d3b-4549-8c17-88b2ba0ef02e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b2d97d9-bce1-494c-a0b5-da2e5d796cbd", "sighting_of_ref": "indicator--6fd620b7-ce5b-4907-a7f5-afafe224aa0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdc0781b-49b9-425b-b02c-62324f642e69", "sighting_of_ref": "indicator--2f160481-cf39-4ffe-acfe-64c6a789bf5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2886d5c5-11fa-481c-bf1a-d923e57567d8", "sighting_of_ref": "indicator--c0e2a411-cf2c-4aae-8698-225b5cd8fd17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a064b1-e016-43c5-aa72-88b30b725b26", "sighting_of_ref": "indicator--49249f96-0903-42e2-a6ad-843264cc3db9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66719597-d6c4-4496-9049-60c5da27b38d", "sighting_of_ref": "indicator--a2cf8d48-1b09-4fde-ab9b-09d57460a9a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647fe1f8-f815-44f4-94f0-fd24cd2b457e", "sighting_of_ref": "indicator--e339950a-c6e3-4207-8f78-fb7cd43bbf43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--149d697e-f7a3-41bc-8c7a-ccfa8d0d1d81", "sighting_of_ref": "indicator--40a6e3ad-eaf1-49e3-b6df-8ca43a30edba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6cfcd3f-6c56-41b6-8a98-9fb9d520e975", "sighting_of_ref": "indicator--f39b53ad-f2fb-429c-abf1-1ae888b7bf78", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc55bba-ca80-4bf2-b944-fad3cd3c8506", "sighting_of_ref": "indicator--b109332d-0b3b-4227-8364-12484a9b5ab6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c24058bf-1497-4a3c-83f6-68c1098d8d51", "sighting_of_ref": "indicator--2f648aa1-c960-4399-92fd-0fd55328e184", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a330fd54-19af-455a-8fb4-3163bf0a3557", "sighting_of_ref": "indicator--0d1b881b-88a7-4ee4-8a2a-ba62ea2c5f4b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0510fa93-6122-40f7-8a1c-2364ec6f545f", "sighting_of_ref": "indicator--9368169a-f77b-42c7-ae65-d42e55959bbd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b0696d-6546-429a-81bf-5e7334086b4e", "sighting_of_ref": "indicator--97c85ef8-a156-4075-8f12-3eeba09db9c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e9ae2a7-7d0f-406a-afaa-f0e939510972", "sighting_of_ref": "indicator--cde1b974-0fbc-4701-a293-156bbef5605d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a33b886-c41e-418c-8016-932a023e4d9a", "sighting_of_ref": "indicator--3c550c84-58d5-4d37-93e9-f117c5da4ab4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b2f12e5-5fbf-48fc-a67c-e50b21844e8a", "sighting_of_ref": "indicator--e0b24516-cf02-4c08-824f-c1f1e960417c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a957706d-8c7f-427d-88ff-15867a0456ad", "sighting_of_ref": "indicator--fa0b5eb5-10ba-4369-8f98-27b89c5d9cee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23b4ede2-8fcf-46b9-9059-d7e5e5fc00ef", "sighting_of_ref": "indicator--543918cf-fbd7-4216-a6a8-3801b9118cc3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d22a014-a190-4489-9970-0f08b353a869", "sighting_of_ref": "indicator--1dbd47ce-1e46-4360-95ca-cfc444956c60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22bd16d0-5af5-488a-9de0-f7857158a68c", "sighting_of_ref": "indicator--3e9cebe7-0a2a-4788-819d-2c3a1dc006db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--584f29d7-fe33-4d79-8c26-9ce30be64d92", "sighting_of_ref": "indicator--496571a9-d560-4240-88e4-dc6e53bbfa12", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35425b5-e9ab-481f-b575-dec4bd56dc74", "sighting_of_ref": "indicator--4231376f-3c7f-4026-b1b2-e94385086090", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b1fc577-47dc-4340-a04e-1c92a91229ba", "sighting_of_ref": "indicator--a34a745a-11f3-486c-84c2-62a1dcbda458", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eef1d7f-84e4-466f-81bb-50621e45f6fb", "sighting_of_ref": "indicator--91dc41a5-6a35-451e-a2cc-2b0442866f03", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83d8b7f1-ccaf-4662-b36e-1937c1f48961", "sighting_of_ref": "indicator--c6e4a580-004f-41d7-8ccd-15fb9436c38c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--470e494c-da30-4eef-85b7-1199430f1ccb", "sighting_of_ref": "indicator--66293ea1-c729-45ad-ab72-6fc8516d16e8", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bda159e2-a90c-475e-9714-5ee17e6b4333", "sighting_of_ref": "indicator--7c9f2ef9-feda-4403-a974-7f32c5710c63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4635ea20-cc51-4277-ac4b-18e08d76c6c8", "sighting_of_ref": "indicator--0f69faf1-bb8c-411a-8213-67101c424c8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a03ab469-7620-42e6-8d3d-23d393f7c12a", "sighting_of_ref": "indicator--717b6910-fdbc-47fd-b04f-957e194ac263", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--456056ad-3eaa-49f3-b1ad-634af304ff0a", "sighting_of_ref": "indicator--a9040fa8-72ca-4167-9721-66f9b215553a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4440fe00-350b-430a-ba52-7b7501f93ed8", "sighting_of_ref": "indicator--831b7635-c191-425b-99d4-9cf7d116fa50", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51e5838f-0063-427a-a628-c321810c6e70", "sighting_of_ref": "indicator--36105e41-6740-4d85-a926-e1997eb3d741", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6fbe9143-8ca7-462c-b70d-077273ec7de0", "sighting_of_ref": "indicator--01741114-47c7-47a4-a04c-acc3e0b0a498", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1b0cb26-8ee3-4478-b6c2-d1060cb9f3d9", "sighting_of_ref": "indicator--126ce028-9d50-4bf6-9431-f60fcae3fda2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739eba94-8345-4350-aa99-d7c4400ed7fd", "sighting_of_ref": "indicator--379c64a2-2bb6-4dde-bc93-763a518b4bb0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cba4864-42a8-4082-9af2-63d167a4aae9", "sighting_of_ref": "indicator--0f4912a8-8a5d-4172-8a35-a9ea205f8151", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec6ed45-e4dd-463b-b75d-50b813ce467c", "sighting_of_ref": "indicator--ee445dab-2408-42dd-8b88-27d7735c3e92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ae0da89-bb23-4502-bd78-78c550a52a4d", "sighting_of_ref": "indicator--f0760045-0fa0-4acc-affc-77a2d6a43c17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b7dd5c5-ef2c-41e8-b039-6734a4d7e773", "sighting_of_ref": "indicator--43e03fe1-a75a-442d-9509-0c426f2be03f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99632b10-b193-447e-8188-b3c2f625f853", "sighting_of_ref": "indicator--5bef7b55-97d8-455e-95ed-f97f62291bc4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e88e7ce8-6f14-482c-b506-1f8d6dc07523", "sighting_of_ref": "indicator--2a9ac06f-6c8b-4b58-ad8e-061acdf93c57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e1cd14d-e970-4da6-83e9-2dd887996555", "sighting_of_ref": "indicator--6d767abc-c2ca-421b-b5a3-e529bacfb20d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--108d5a99-eeff-4fda-98cb-98fc8da5e8ed", "sighting_of_ref": "indicator--a70484ba-3974-41a1-b072-867414dcbbf7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cdffb16-f203-4b3e-ab5b-34c76e39ad47", "sighting_of_ref": "indicator--3e701859-3771-430c-a5f5-4a424e177106", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--522fd64f-46f8-4bcb-9944-1e1f9db6fae7", "sighting_of_ref": "indicator--4b36cd11-0d08-4251-b980-1db6853febad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53247838-03da-4916-bb82-c1fd105148f5", "sighting_of_ref": "indicator--9687b8b6-aaff-4366-b2ab-2c87e5481a53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24ca6d1a-bc50-4827-a003-40d23f067169", "sighting_of_ref": "indicator--21b826a8-1b7d-4f45-b2f1-63e33488bfdd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--866c890e-d28a-4a53-9c40-439192746db0", "sighting_of_ref": "indicator--ed8deaa1-ee0e-49e7-9724-7c6c19ff9c35", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8b3325d-9128-4608-9934-70f3add348ea", "sighting_of_ref": "indicator--c26450c9-579e-483b-b289-a25656980844", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83c1365f-573c-4f18-8554-d9d9ca341b47", "sighting_of_ref": "indicator--980a5910-5971-4f4b-ad82-333d0ef38050", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73707eae-ae8f-403b-8902-0427ff6953cb", "sighting_of_ref": "indicator--057559ad-335d-4c5a-9035-2107e8e1af8b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a485ed7f-b225-49cb-8b4d-c85d6824d7b4", "sighting_of_ref": "indicator--d972f4a4-95e6-49a4-950f-121e146b21d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7e59a6f-67ea-41c6-abb7-8ce0767ee3b8", "sighting_of_ref": "indicator--bc5fb0dc-7eee-4dc0-bd62-69a211aacc98", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f42021e-a5cb-49d0-a252-a15f2a26dedd", "sighting_of_ref": "indicator--5a39f6df-6875-4702-a9d1-922991153a64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bd96234-81fc-4e1e-be13-31f792a320d9", "sighting_of_ref": "indicator--3fa4d925-5f95-4434-bc45-6ab11d45519a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f310c6c0-f26b-48ba-a284-10f0f13d7c11", "sighting_of_ref": "indicator--a9aa891a-0496-48f9-a61a-83406a791eb3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3202fdf4-66ab-4424-a8c5-1982f7b338fc", "sighting_of_ref": "indicator--11447d6c-80aa-4840-8ebd-065698bfefb7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5212009-cd0d-40ce-bbaa-43f0daf84407", "sighting_of_ref": "indicator--cd27d532-c9b9-4588-be43-0c45ea102ce0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c075f83-ac0c-41df-b3ea-a569e33bbfe9", "sighting_of_ref": "indicator--f4a772af-dc27-49a1-ad94-7738505259f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ebf50be-68f8-453f-a7f7-6834a0c48bd6", "sighting_of_ref": "indicator--83d540b6-6408-4533-958f-03f3fec19a0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89f590f-f491-4289-9390-3cfcc61ec671", "sighting_of_ref": "indicator--08cf8b3e-f784-46fe-9b8a-94c3e9861918", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17bdc138-beda-44f7-9117-a6c55ea60002", "sighting_of_ref": "indicator--21dc9cd1-f77c-4548-aaa9-be7c9dd87319", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8167d47b-ad5c-4610-950e-c7714b92a83c", "sighting_of_ref": "indicator--6388241f-94a4-4763-a155-c3a701f3cbbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7b22f82-5041-4c6e-ae07-9cbb3dbe9c8f", "sighting_of_ref": "indicator--80ef04ca-6a33-420f-8952-3f16915213c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f1f152e-c852-4fcd-ba28-32a1a8e10287", "sighting_of_ref": "indicator--4d405b6b-2ed5-4bf7-9a0f-58c906090d84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d6f3fe-40ed-478e-b2e4-cf5fd619d349", "sighting_of_ref": "indicator--9d22f4fa-4aea-4f66-8423-2d4ed96dd553", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--520c9091-1032-46f6-b592-b277b8dd50b3", "sighting_of_ref": "indicator--e7470dd3-599a-43a7-a1fc-ec0d0981dc6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--545bac2b-de84-4397-83f3-b07955763322", "sighting_of_ref": "indicator--8373e18d-1785-4dd5-a5d8-e1aae8169acc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befcf8eb-d1bd-4529-b6ae-03e7661d477e", "sighting_of_ref": "indicator--6996b3b5-7f37-4029-aec2-2d082fea0b6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef5b8467-d684-4ff4-8654-373ad3bd90b1", "sighting_of_ref": "indicator--ad2c21f1-b7b1-4e9b-9135-c166138973a8", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67e31f4d-8c8a-4172-8ada-5b3793ad5a76", "sighting_of_ref": "indicator--2634ec67-d141-44c7-b96d-a4a5c38cc85c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6240d2-b98c-4533-aca4-729cd9327d3e", "sighting_of_ref": "indicator--25100aaf-bfa5-40b4-8cbc-c43d3a24c4bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d0a493-b8da-4c8f-87ca-e1b88215dc78", "sighting_of_ref": "indicator--6b5a2b62-0264-4158-acb2-30905b75c170", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c342fdd-dae3-46a7-915f-89fe9d023d9b", "sighting_of_ref": "indicator--5beb4453-f673-4dd7-8e31-9951eb44b0cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf809674-633a-41dc-9719-57ccac7cc6fc", "sighting_of_ref": "indicator--e75a819d-c466-4545-a4f3-aeb7eef762fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf87ee7f-9e0c-459c-8d56-dcea22acc6f1", "sighting_of_ref": "indicator--4244b673-b8b0-4b3c-9178-73b6ffb86092", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d5a76f0-326d-437a-ba68-82a4c58c193d", "sighting_of_ref": "indicator--75c28897-bc97-4f05-b9dc-f367bc23120c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2c3d6b-7501-42f4-88d9-eaefb539973f", "sighting_of_ref": "indicator--d4d29222-1ee6-43e7-baee-8540c770d3b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa615a05-5be3-4bb9-85e6-259819c8e0ad", "sighting_of_ref": "indicator--798e9dbf-a818-4308-8c50-543ad1cb31fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9575e5-4e0f-4c06-91d8-31ee38ad1df9", "sighting_of_ref": "indicator--1d69a2ba-998c-4d0e-96a1-31418c97ba2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--863d3d76-bfae-48ce-a4d1-c3d54c36c11f", "sighting_of_ref": "indicator--541ee551-c077-4bf3-9a11-0502445d7818", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77d2328-f531-4462-8cdf-91ff7c7e1136", "sighting_of_ref": "indicator--8616b543-709e-4e22-bd76-3953148ca10d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76800840-acb4-4297-8dae-198f8b2ac9fa", "sighting_of_ref": "indicator--1c79f65c-d96c-4e4d-8dba-0d7a9918897f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33c0ed61-509f-4ccb-8c23-06325b70629c", "sighting_of_ref": "indicator--2f7168af-36b2-49ee-ab22-35dac0adee84", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--919a9a8d-e570-40ba-8c4d-f33df9942bbc", "sighting_of_ref": "indicator--44068cae-b84e-45b9-950b-4a7c5990be5d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--258520b0-6d3f-40cb-973b-fced097f063f", "sighting_of_ref": "indicator--68c718ee-9f69-4dea-8cba-157e45cf2f83", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f786f56b-e070-45d9-8714-c3d0ac956c1d", "sighting_of_ref": "indicator--884a6e85-b927-4eb5-b128-2334a8a3fbb6", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a1c5dbf-b07f-4ad4-90fa-6fbe1b429091", "sighting_of_ref": "indicator--6662f280-da3c-4c02-9e70-93d02fb49585", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76e89f2f-30da-4b4d-9846-9fbd96a4ec12", "sighting_of_ref": "indicator--5437a8b1-898a-458f-8257-9cb67f9e882c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0485714b-73f5-4f91-b6cd-9237311d3616", "sighting_of_ref": "indicator--97248120-3950-495f-8827-a031dfbc1070", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40ab726a-58ba-40a9-9990-b6ea672e7577", "sighting_of_ref": "indicator--e4444129-130c-4382-b344-bfc6845fc5af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0246d96e-10d3-4128-8167-707405df6a53", "sighting_of_ref": "indicator--f98c87c3-684e-4947-bb17-942a5f7acc4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd94b387-58df-4036-bd0a-a37d1ecaa37b", "sighting_of_ref": "indicator--f543afe4-b1f6-4de9-a233-e30e79f27778", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d38153-584a-43a5-9bc4-2e91f157ed6d", "sighting_of_ref": "indicator--bef3856b-98f0-4691-be77-205ab5f72d51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54047684-37ea-4520-acf7-f25da6be1fb4", "sighting_of_ref": "indicator--bef3856b-98f0-4691-be77-205ab5f72d51", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9895a3fe-9896-4307-8049-0a52cea5374d", "sighting_of_ref": "indicator--4a2b1768-1c56-400d-be66-9c2cd99053b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ec2f023-7854-4ed4-b36c-082f63fb26cd", "sighting_of_ref": "indicator--851b6f39-a44a-469a-8cf7-fc798bc927da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d567bd-0aae-414b-9dc9-c525047d383d", "sighting_of_ref": "indicator--57b82c09-a57a-4ca3-b40e-2f08c96c881e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4c8f4d9-cfad-4e4e-9c1a-2d0b21bb931d", "sighting_of_ref": "indicator--ce4bb4ae-aea5-4a07-a4e9-7a513e1b517c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7353ed05-66a2-481d-bd2a-7a0dbd0946c5", "sighting_of_ref": "indicator--835fb0c4-3813-4678-a040-ff0ad76d7664", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b7aec0a-b769-4941-9564-12536d0da2b5", "sighting_of_ref": "indicator--1b55ba73-7620-43a8-aa33-484ae000c142", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e7f076b-f1fa-4332-87fa-ae4efac921ab", "sighting_of_ref": "indicator--452519e5-1081-479b-b49f-e88c8c5d0b46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b928935d-f0f9-4809-b076-54b0aa2fa460", "sighting_of_ref": "indicator--08d7a7de-553e-4dec-9b2d-a2eccfab1a4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe52996-4caf-4401-8b8d-0aba37e2b2d4", "sighting_of_ref": "indicator--fe4d72f3-252f-44de-86d9-25dbcf657ba3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd54bcbe-5404-40ae-8035-53e837153c0e", "sighting_of_ref": "indicator--dadc783b-8a6a-4282-9971-cde9820899bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfa241f3-9834-46cb-8b2d-b11860459f91", "sighting_of_ref": "indicator--dbd26782-9af8-4ec3-8f95-1bc0df29a930", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e50dc0d4-bf88-4398-9b84-c11773008770", "sighting_of_ref": "indicator--86d28595-b4b6-4b3b-a1f2-d2b78dd0b600", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fcb81e3-b639-4018-80fd-26a07c0824f4", "sighting_of_ref": "indicator--8181de87-705b-4acd-af5c-76a6dc9278e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bddebd2d-7a83-4f7c-88c0-410a93a60630", "sighting_of_ref": "indicator--8a59d2ff-972c-4f97-a56c-422dc79214ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f89220c-e6f5-465f-8644-05320cb520b0", "sighting_of_ref": "indicator--38aa4085-27cf-40dc-a224-ab751bef207b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ed4b03-9dd3-4142-9c7e-28962dcc3dc3", "sighting_of_ref": "indicator--6510ff29-0e25-40ab-8bf8-6551bfcd2968", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8511ed0f-250f-4743-bfde-aa20a16e069a", "sighting_of_ref": "indicator--6c7edca3-f6d5-46e0-a3b8-0f97c8effb71", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b7c6ac5-1b60-43aa-8658-f9e5f43f6a7d", "sighting_of_ref": "indicator--718f8d6b-f912-4947-9cc8-69c99cc27466", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7522b225-bf6c-4fb5-b29e-f7a3e70c5b7e", "sighting_of_ref": "indicator--8d26caf6-d213-4146-a26e-b9f93ed98766", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11d884f-a938-4111-b8b5-e8775cd4e473", "sighting_of_ref": "indicator--d48b9939-3e57-4a55-99df-e47b11ce726c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a22fb2a-e953-4e13-a732-5577a0cef4cf", "sighting_of_ref": "indicator--f225be4e-7712-4c97-85c8-df7b1b04f516", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5988a91-d081-470d-b0e7-4329708db930", "sighting_of_ref": "indicator--74fb1696-234d-46f6-b1b5-881ed8a4fc6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce9b9e9-d92d-4a75-bfad-8722987d47db", "sighting_of_ref": "indicator--1122d6e3-2e78-43ba-a7c1-12fd39cb764c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--468be1cb-7756-433e-b4d0-89c8a4359289", "sighting_of_ref": "indicator--f79eef4f-719e-47d1-a1b5-797928dcec33", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e287423-6294-48a5-8264-ad481a2d3bc7", "sighting_of_ref": "indicator--93f3a533-78ae-4a07-b7d9-88486b1def2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99c615ae-ee01-4bfe-98fa-531b6cdbde1f", "sighting_of_ref": "indicator--202fd2ce-c82e-4979-b053-44b7cc631ff6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--223386ff-3588-485f-b9ba-90a035d32971", "sighting_of_ref": "indicator--8a6e4a60-8bbc-4cd8-9071-f6f2e75bb105", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--993a0268-2323-4ff5-a31c-2750e165957d", "sighting_of_ref": "indicator--057d3161-4375-4f45-b386-a2ccba5dc7ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ba92e6-da45-44f3-adeb-8474730adcbe", "sighting_of_ref": "indicator--7ad58bc5-f8de-4f52-a37d-57df27f0261a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c30ebea5-34a2-4bbe-9096-62592238c78c", "sighting_of_ref": "indicator--140f5bb5-eeb8-44e1-8b52-9c4d4dcd6c88", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab3b80c-99a4-4a20-895f-04b4fcfea802", "sighting_of_ref": "indicator--36bab1d3-fff4-4327-b3bd-10cabe8631b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3a4fc6e-fffc-4918-bb8b-d5f11d9b5ef6", "sighting_of_ref": "indicator--5c1cf91c-725f-4774-85c8-396b508c6a0e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a70a22f-25e3-420f-90e8-a2aa64c52250", "sighting_of_ref": "indicator--d2fb8069-8595-407b-8a8d-54aa27f4def8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--405c914f-8aaa-4d6a-bc85-fcd6789916b8", "sighting_of_ref": "indicator--ecf52262-8317-471e-8cbf-4c298e21b917", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcaa8aec-92d1-4fca-a443-0bfec5c9ed16", "sighting_of_ref": "indicator--7aa3de83-f3d3-46d1-b99a-e6af57c1a1c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e69ab5b-3c28-481c-9bbe-ecd7feaf3a84", "sighting_of_ref": "indicator--b524fd33-7745-491d-b00f-4fca08fa281e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30c93937-9a49-4d43-8157-6d9e35655cf0", "sighting_of_ref": "indicator--72931c71-5764-43d0-b5af-3f15b489ae1d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe39f3f4-2427-4256-8891-7f75d6691457", "sighting_of_ref": "indicator--ca8b97ed-848e-4bcd-a065-67439e4c9949", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d90f692-e804-4232-a8a8-337a70a50885", "sighting_of_ref": "indicator--43e81916-e9d6-4a29-80ec-ae410c41ee67", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--093e985c-7fa0-4820-8b0d-1df3dc82ed78", "sighting_of_ref": "indicator--49d1bdc3-b92a-4f21-ad89-dc28ab85a0d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--322edc86-1aca-46ef-9cc1-c2761548dded", "sighting_of_ref": "indicator--a01162d7-fa04-469b-b2c2-b1c93cb17af0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41911de7-52e0-4116-80a7-08143a2ed4a4", "sighting_of_ref": "indicator--a77ff3b1-ef56-4367-abf3-dcb7de1493d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--136ac323-5c36-478f-a07e-8165a281f511", "sighting_of_ref": "indicator--1a6686b9-4a99-4ea6-989b-4402f84b5ce6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--464b0364-eaac-4100-bc30-45e989ee1690", "sighting_of_ref": "indicator--a5ba495c-7fc8-4809-8e4d-495ec0b221b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eb1da15-b2b2-4439-9424-8eb38cad2178", "sighting_of_ref": "indicator--11988057-f811-4bb4-935b-2a37ba6714c6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b86aa6c-a9a6-48c8-967a-a6efefc278b1", "sighting_of_ref": "indicator--ef6b753d-36c1-4368-af64-ad049ba664c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6716e648-676b-4366-b3c0-f8feaad0f94b", "sighting_of_ref": "indicator--2fa5ac35-a5a8-4d5c-8a73-633c5d34b68e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8eb6637b-6a7f-4400-b945-456d54fd81a7", "sighting_of_ref": "indicator--af34acdf-8a29-4721-8b6d-46cd564c798f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d5f623-d0b1-46c5-9bb3-a51c61bab752", "sighting_of_ref": "indicator--01035c08-6abb-4b80-a681-846fb63b0d2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab8b51fc-4dfb-4240-9c80-62ad9bdf861f", "sighting_of_ref": "indicator--6ad012d0-b7c5-4e7a-a173-113225820412", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96a7378c-443a-424a-960d-674c495e6236", "sighting_of_ref": "indicator--10fb375a-853b-4a04-ad75-f1a0a239e9ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f9bece3-b2c9-40cd-88cd-a1443a27270f", "sighting_of_ref": "indicator--fdd31c1d-ddac-4f11-af10-a7ba567e0880", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7490335b-136c-4c9a-acaf-cf86169d3db0", "sighting_of_ref": "indicator--bd7a85f9-518e-4d5a-97a4-6479b62de93a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae16116-3f97-4f42-ac5e-476a24fde470", "sighting_of_ref": "indicator--b0077e39-c909-4180-af42-6e6fd37fff4b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e25a0c37-6a9f-42d5-b080-3bb3403f9c96", "sighting_of_ref": "indicator--2a94dfca-25d4-4cfe-8bd5-5b6585016dc8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85d16caf-77ce-40cc-b91e-be891ea510c8", "sighting_of_ref": "indicator--b5fbf71c-fa53-430c-a25e-b209ce9b212c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11c07714-4df5-441d-9320-15964f5abc8e", "sighting_of_ref": "indicator--eca8b127-a50a-4b0b-9c0d-b1d06a65070d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe6ff32c-049d-428d-86df-a5a3654e9d48", "sighting_of_ref": "indicator--4f16b573-d42e-403b-8a94-81fb022d64ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--855037c5-751b-4c03-8bbc-8e4071ed486a", "sighting_of_ref": "indicator--b19c7cd5-5cd6-49b8-a699-7796247ac0d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91c8a2d2-003a-4b94-a40e-9197aa40e814", "sighting_of_ref": "indicator--b6cfdbb8-817d-4849-b199-8b01aea79fae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4114ee1-6d7b-4565-b4ce-b23753fae4df", "sighting_of_ref": "indicator--f5e9a28d-b58b-4609-90f2-5c6c8b1d7b25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fefe66d3-de4a-4fba-8226-c43620470c0d", "sighting_of_ref": "indicator--f12d2bcf-b33e-4024-8a81-1e20b2eb0403", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a78b592f-1a6f-43ba-91f0-f1cf24c30577", "sighting_of_ref": "indicator--baef1795-2a51-4871-8ee7-6dd08243089f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4e199c9-14dc-4604-a461-6289aafc23c4", "sighting_of_ref": "indicator--85db0dd4-e4bd-4900-8054-1000df05bf24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6680e74-4b32-4108-a990-debb8c5c9850", "sighting_of_ref": "indicator--f06f304c-d36b-4930-9ebe-144bde5845a3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e29c0ea-1bda-443f-b26e-dff78604436e", "sighting_of_ref": "indicator--d548f548-3a30-48bb-82f0-590eb0100fca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--524ebee4-281f-48c1-ae44-f1901346d22a", "sighting_of_ref": "indicator--5366b5c8-ec1e-4f49-9f78-498720275583", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1d9a4f2-7327-4976-8d40-f057d988c6c3", "sighting_of_ref": "indicator--81332d1f-078f-4a74-a266-1af0d4085f31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2c35b14-c5b7-4d1a-b8b8-465a9b0b806c", "sighting_of_ref": "indicator--4b7ec767-4442-4889-beac-ae2737f5c3a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73222aaf-2498-4eb6-9d79-23e46257b7ed", "sighting_of_ref": "indicator--bceb088a-ede2-461f-a06e-c695de339172", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31dcc764-442e-4778-9bae-da497645a282", "sighting_of_ref": "indicator--4f32dc29-810a-4039-affc-92661d618187", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8d2915d-2ec9-4ce4-bc21-6298517ffd75", "sighting_of_ref": "indicator--c508ed98-e8e0-43b8-980e-ffcb7030da9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63d47fc5-b2bb-4189-a31e-5e6d2f91b973", "sighting_of_ref": "indicator--b1d946e8-716d-4c79-b8e5-d7cbf36ac790", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06489c5a-1d87-4f7b-b7e6-47394c8fdb7d", "sighting_of_ref": "indicator--bfbd0a99-4c81-4eb3-856c-7dd1094cc7bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf9eb45-1db2-4466-b5f0-07cfb1117c58", "sighting_of_ref": "indicator--98558bc7-d18b-4b4b-8873-b6eeb536313d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7183ab78-42fc-494a-8d1d-0a4dc32c2660", "sighting_of_ref": "indicator--831e26d1-4488-46b6-83a8-b02e8a796e1c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e48b68be-3ff4-4f2d-842a-f62f5e1c8ee5", "sighting_of_ref": "indicator--dedc4e96-a1df-4d24-b732-9d04214f67ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--496adfdd-1824-41c8-8a14-dc19defa9b05", "sighting_of_ref": "indicator--5993de0b-dd9d-4012-86e9-eda5204f3703", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79f08a3f-70d8-4208-b3aa-77923e03ff25", "sighting_of_ref": "indicator--3f7b88cb-b315-44c5-a746-e7955dc5af90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaf4b58a-85d7-4f36-b454-b88a26e47bb3", "sighting_of_ref": "indicator--7db67744-36ff-4484-82ca-616f051a7a89", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--459ec19d-2a5b-417d-adce-5a36865cfef0", "sighting_of_ref": "indicator--b42f45d5-5ebc-4537-9a19-011883240838", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49e08af9-0027-4676-926e-ed5f978156a4", "sighting_of_ref": "indicator--d6bc8866-0fc1-4201-9765-f481d0df7087", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b706f37-2dde-4f9c-b4bd-b5eca45bd92b", "sighting_of_ref": "indicator--05e02023-e01c-4891-9284-b9fb16911800", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8037e4a-6a4d-4703-b548-235b2104c7e6", "sighting_of_ref": "indicator--58135573-75db-416c-8d91-659bada91d5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b8d7e69-a4e3-4fc3-a33e-1b7b10eaaf9b", "sighting_of_ref": "indicator--a52dc138-cee9-4987-8716-075324c22b13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ad0d2c7-cf17-457a-898a-c7768701e48e", "sighting_of_ref": "indicator--fe51532e-aa56-42df-9d6a-e1a248878a2a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdf2ff64-3269-491f-94cc-dc2a93f2c746", "sighting_of_ref": "indicator--d53611c5-eb02-437d-9bd0-3ec1ab9cadec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17a54c8e-c7e4-40a5-b47f-075abe45251c", "sighting_of_ref": "indicator--5b4fa0b9-ff2c-4534-bc46-d3a66dea468f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--342ec84c-10cf-4453-9e64-23f5cb867716", "sighting_of_ref": "indicator--0ce0db5a-5786-4165-ad86-4b8ed3e8e0db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9587904c-022a-4aac-90fc-999f231d49d5", "sighting_of_ref": "indicator--f6e030bd-0e80-4984-9166-5d9ede0e8d11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f6fb810-c968-4769-b5ba-d9d76919bd53", "sighting_of_ref": "indicator--df84f09f-f4a8-48ad-8109-994d681729f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--354a6260-fdeb-4380-8017-df5fa2736f86", "sighting_of_ref": "indicator--d8260594-d2f2-410c-93e4-97e4921aef22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61e1d5d-79c0-4e95-ad1f-919f0c2b96b4", "sighting_of_ref": "indicator--317ca601-c289-4624-af6a-d3d4acafadc6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--934e40a0-2371-4b62-ba68-71483afc319c", "sighting_of_ref": "indicator--09bd3803-9056-448e-b68b-406908ec5027", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e5e4d9e-b2bd-4c20-b10d-f15e11862b02", "sighting_of_ref": "indicator--1011d23b-3a11-48f6-96d1-174f56b72cd0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59faeb5f-1199-44b0-80b5-3fe4bd343780", "sighting_of_ref": "indicator--89a87d13-764e-4c76-93e5-14a630735d10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e7bc7dc-459e-402e-a835-b4c27682eec9", "sighting_of_ref": "indicator--a33564d2-b3a9-4ae2-b363-080484e61b23", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a46cba28-c85e-44c7-9e78-9909362f33c9", "sighting_of_ref": "indicator--bf60ea9c-0276-4528-8afc-04e06e1e8c21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b06cbb9-ffaa-4ace-bae4-0bb17ab0571c", "sighting_of_ref": "indicator--b15854a0-7ca7-4f97-b5e6-2897724bcaf0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266ac18d-94d9-49b8-b689-90c82f233f78", "sighting_of_ref": "indicator--bb411892-4c95-4ddd-b12d-ec27ff729862", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86a43c47-450d-4c02-9294-3af39afb05f2", "sighting_of_ref": "indicator--11a7ac10-9221-4fe3-a838-31d0136d89a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e75b271-6fb6-4e25-b3d0-a868b489fbc4", "sighting_of_ref": "indicator--8ddb2fd1-fbcc-4d7a-b0c8-0b8ccd3479c7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a2655bf-dea4-419d-a123-4bfbfef236aa", "sighting_of_ref": "indicator--c073029a-8e9b-4ab6-9cb2-df228fc44b04", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb568b0-9476-470f-a2f3-7e9352faca16", "sighting_of_ref": "indicator--1f14bde2-08a5-45f7-9401-39f15c6dc467", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d207ab-4e76-45b7-a333-295340c2348a", "sighting_of_ref": "indicator--6e3b08c0-6da6-4870-bc92-6893a5f8bc18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b383ead5-c6ea-4c27-af7c-f9b73f1d0fa1", "sighting_of_ref": "indicator--a2e42aae-3e89-4f83-b716-d6eb11d09814", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--253c892b-10c1-49e8-a2bc-f58f0de7d43a", "sighting_of_ref": "indicator--b2050f9c-73a9-49a1-ab91-2fb908bd338c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f13e66-ea13-47c2-8ce3-4f9124a76417", "sighting_of_ref": "indicator--79d0c546-7af3-49b7-b273-facd0fbeb4a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--274f2370-1c76-4f85-8424-956dcf4e15a4", "sighting_of_ref": "indicator--f8c1d6df-6b4c-45ab-8f44-0f19a1586efc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb0867f-acad-4b93-bdcf-3c582fa0aeea", "sighting_of_ref": "indicator--19fe6969-e962-4802-b210-2021d0a21cd5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c164c5f-6531-4de8-98b4-60c7318a4568", "sighting_of_ref": "indicator--88871a96-7d37-42a4-939e-cae958f37434", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451c4735-0d47-4f13-88d6-a97e19c1fdbd", "sighting_of_ref": "indicator--64ae3ab2-0a9f-4ec7-8925-9e98e0e78820", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f728e81-ee63-4b02-ad87-6a2be15775c6", "sighting_of_ref": "indicator--6cb57131-23bf-4df1-960e-f0dfc1e829d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e4e6112-e2c1-4306-af35-99afa98f69a6", "sighting_of_ref": "indicator--402e2ba5-6a76-4f71-a2ed-cf1f65d2a240", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af2fe822-722d-4918-bb6c-33fb1aebf3ca", "sighting_of_ref": "indicator--68c93d66-b161-4b50-bf22-a2441d0838ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb4ee380-9e4a-4fa9-9bbd-ebf71801d49a", "sighting_of_ref": "indicator--cb65e954-8a1a-4d49-8a81-998e4e775b4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8770eacd-06a3-4c8f-90f3-649075e8f8cf", "sighting_of_ref": "indicator--a715dd61-8dc3-424e-b58b-a5b9f9a6f5c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6497786e-48e5-48bc-8229-7679a6b40fb9", "sighting_of_ref": "indicator--6e0480f9-7b09-4e0f-8f7d-55dee681fcab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8db3d4d4-8147-40e3-b40f-5279bb4840be", "sighting_of_ref": "indicator--ed1f450d-819e-4404-9253-091f8fa0568d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1613e580-f74b-403b-8087-f28ddae68271", "sighting_of_ref": "indicator--2c0838f6-b4bb-4bf4-80bd-fd080018271d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--111a3729-5302-475c-a216-c7186258346f", "sighting_of_ref": "indicator--7fd8b07a-1d54-4b99-a2f2-3737a1ac048a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cf8d453-fafe-4582-a0c4-82d908b3a019", "sighting_of_ref": "indicator--b38d46f2-921a-4f1a-95f1-747dfccb9752", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bb33888-807b-45dd-bbd1-61845dab5160", "sighting_of_ref": "indicator--43d015d7-44bd-4093-865a-dc53fb47bda8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24999869-4abf-4e19-82db-570088f6e9ba", "sighting_of_ref": "indicator--892d16b1-9f44-426f-a9ef-252c00bf3d5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63582af6-fe3b-4174-9113-9c6d5f0e07dc", "sighting_of_ref": "indicator--089c52e3-4be6-4530-afdb-51c1d4e09036", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f7b8f5-3601-4715-b38f-efd0ba5d5137", "sighting_of_ref": "indicator--bbf2a44a-eddb-4f19-b9a7-d3b7bbe9ceee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9ac595d-7f28-4a1c-ac15-dcfd05e13fba", "sighting_of_ref": "indicator--b6c6bcda-a706-4868-bc0f-dce703f564af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7796b69b-0401-4281-9e08-e4402d47ac96", "sighting_of_ref": "indicator--b8d24f00-2594-4681-8733-ce185ec0d144", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91712540-6c36-409a-a85b-301fc52e092d", "sighting_of_ref": "indicator--d81033a7-10d6-4560-b35e-59ca62b2ab2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23568751-a2ad-475f-a0a5-b1868d05ed2c", "sighting_of_ref": "indicator--dec2b0ee-b585-4f04-a58c-256928703e41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d2d96b1-5d8a-482f-a673-c0cf889d7002", "sighting_of_ref": "indicator--55ffee8f-0bc3-4115-b364-9c74a17ef823", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1012476f-1fa3-4e25-a6cd-c344f55971b7", "sighting_of_ref": "indicator--d64bd035-2c07-450c-81e0-daf0d45e080a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d794998b-89f7-45a9-aec9-8c8ecd8f3f0f", "sighting_of_ref": "indicator--2a525d4b-3419-4e85-8a5e-c3d0db9113ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70013434-e5a1-4cb6-a1c0-64ee655510ce", "sighting_of_ref": "indicator--e0aa0c40-f36f-48e5-a4c9-c78af935927b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bf7cd2b-f056-4815-9bee-428bab5766cd", "sighting_of_ref": "indicator--450f8be2-6fb3-4c63-adbb-dab93cc024c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0239e9c9-4e0c-42fe-ac47-0ea98b68a6ab", "sighting_of_ref": "indicator--1eda52c1-0261-463f-81c3-502d8cc9ccf5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--276a2cf9-1389-408f-92be-276763459b3c", "sighting_of_ref": "indicator--82c9e185-df70-416f-a001-ebc62a0d348c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24f97f5d-1a66-4803-a888-70f8dbe13975", "sighting_of_ref": "indicator--409cc9fd-8eff-4e52-a259-4ad30b15e580", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a80af8d3-2769-4e69-8623-baf2155217d9", "sighting_of_ref": "indicator--46c14cb9-d604-47b1-b3d3-0bb0aa7d37dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b746b688-9b7b-4d02-99e5-0a256cac0865", "sighting_of_ref": "indicator--47b5801b-b624-4bcc-a14f-efbab9f2f158", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cbd6bbd-8606-4e08-b33b-3781fbe1722a", "sighting_of_ref": "indicator--e7373f84-6e6d-401f-9b1f-aae6c49b7adf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b9f25c9-b772-43d2-a000-245f8ea1d6ea", "sighting_of_ref": "indicator--18024bc5-a849-4f9a-875d-0cd49f54cc19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11140480-87d8-410e-83b3-0e1f96398ca3", "sighting_of_ref": "indicator--3c56cdb6-3f73-4a5d-8410-ab6824e02e64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d7f7dd-4e03-4505-8b4c-a74df3ef071f", "sighting_of_ref": "indicator--cdd30599-c4e4-41b4-bfbc-04f6624bc413", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd49495b-3189-483a-90cd-0f64e08e517a", "sighting_of_ref": "indicator--acf4cfbf-ee86-46af-b0de-e3c328837ee5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2224549f-acb0-49fb-b50e-8626ff631240", "sighting_of_ref": "indicator--d83e3fa1-bed7-405b-9442-927d4e4f1de3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ada9dbc-c316-44be-9c08-f03de01bfbb0", "sighting_of_ref": "indicator--ced14d14-0403-4249-963e-935a92b601d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7152a6d5-8bcc-4237-9341-914704677c33", "sighting_of_ref": "indicator--41a14d2e-e235-48cf-83c3-a178491c9718", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcc98880-c2a3-49ad-8c5d-078b7d89b201", "sighting_of_ref": "indicator--779a9a98-7716-47fd-9929-2137e04eee94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cbe7f03-bddb-4666-a5f4-a5422c891c22", "sighting_of_ref": "indicator--da69ce68-47ef-4305-9170-6fac81a34ddb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64034db5-315a-4f1d-a7e8-90be737be273", "sighting_of_ref": "indicator--ea4d3721-d250-4a7c-b189-3029f0326800", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ca89d68-aea8-45f1-ba85-b176a0906be2", "sighting_of_ref": "indicator--c92f2e87-859c-4483-ad5c-a93dfb81aae0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8d1f4d5-a69d-42dd-b596-7b3655b92d66", "sighting_of_ref": "indicator--002b6c17-3276-4db1-8829-7e46c9a2a455", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a222b621-1ead-4bd3-a499-772242423d53", "sighting_of_ref": "indicator--6c923337-a1a3-431f-86b2-2d72275a5aea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d96a512-4859-4108-9c07-e2a51b4d4156", "sighting_of_ref": "indicator--0bed0334-cbed-4355-bd86-8cd0d5b180ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8e34c2-b0c4-4deb-8524-0d8e5b922db8", "sighting_of_ref": "indicator--fa92beab-12a5-4316-a1c2-6fa4375795c7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--321c2b91-d19d-4fc6-984d-44694de91446", "sighting_of_ref": "indicator--ce7f210e-baea-43f3-b788-64bc1e913a17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf17ac2c-5e4b-4c50-9c3e-658c58c48df3", "sighting_of_ref": "indicator--65cae14b-beb5-4f1d-9ff2-222e039a5042", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f082f19-3b1f-41c8-aa21-1c3820be953d", "sighting_of_ref": "indicator--ced2fefb-8469-475f-b777-05756d321486", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2647051f-a752-4f59-8687-dacb8f6b28ee", "sighting_of_ref": "indicator--c575a1a5-9d76-4bf8-9387-3ee9967c6b0a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e337411-b455-4588-abbf-296a6290c24b", "sighting_of_ref": "indicator--f2fafc4a-a62c-41ec-96f5-133fa33eaffa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--075c7c5e-8747-41ac-90e8-52447c96c1a3", "sighting_of_ref": "indicator--9551ede8-5d52-4280-85d1-a74d9790c9da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--777b6718-9395-4ec2-b3fc-28575e59f9de", "sighting_of_ref": "indicator--e0d4aa91-63ec-4892-b288-04d58f858548", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b44c3a1c-10ff-406d-ac97-506e2107d0d5", "sighting_of_ref": "indicator--bdf83ef2-fc85-4c02-a845-cadcb4be844b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0346da5d-7a95-406f-a63f-be6afb2cbcb6", "sighting_of_ref": "indicator--4fcba273-906f-4bdd-8496-cc254bc5e18d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f3f1e0d-b8b4-47be-b081-d1de59293bed", "sighting_of_ref": "indicator--28f0b7b3-15a0-4787-ab8d-b7d6bbde2faa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c0cc37d-853b-4a52-8188-64bdde83d9af", "sighting_of_ref": "indicator--b39dc72c-2aa5-4345-a70f-ba3b2efd4d5d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2093966-0533-493a-bc04-43205ecfe562", "sighting_of_ref": "indicator--ab15e3fb-4ba0-4811-a710-a0f4ea2980e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03192342-f2d2-4558-9bf6-834382881893", "sighting_of_ref": "indicator--32decccd-e2ba-4887-9655-31a731512bb9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0653fd28-321b-4ce1-a6ad-1ef53ea11eee", "sighting_of_ref": "indicator--e547d800-4be1-4e86-94be-9a217b3d343b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df6b3843-0fc3-42ee-a502-40c5cfd0e4aa", "sighting_of_ref": "indicator--475e697c-657a-41ad-9972-ca2ae3a64583", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eafc7ad5-0c73-4711-aea5-64bdb29494ba", "sighting_of_ref": "indicator--576dd332-4385-4088-bdab-2b8999c32b51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c299e91e-cc60-4465-8a21-5084eed28376", "sighting_of_ref": "indicator--f953eb56-17cd-4911-8394-92bf0da33617", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e763e243-ba89-4c23-bf6e-b51b5cc78a6e", "sighting_of_ref": "indicator--6db1d2e6-fb41-4e46-bc50-a5a2e7b9d3c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eccbe265-9e67-4ed9-bf4b-9f380b677501", "sighting_of_ref": "indicator--2dd58eee-9391-4785-a79e-43e4e61aeb88", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--424af5e9-2af7-4afc-aa9a-bc65a19a4909", "sighting_of_ref": "indicator--fc63db85-82c0-4019-be51-4288723e5ec6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7589302-5d00-45d2-af0e-e191ec7cded2", "sighting_of_ref": "indicator--c05df294-55f9-4a5f-a562-44be52092c43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3f9ebd-254f-44b3-8df6-52e358ddf6ba", "sighting_of_ref": "indicator--c36bd5a7-8d1d-4e70-8a7c-e1895b948f92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37f7329c-fcfd-4c5f-a4cd-31e6844f40e2", "sighting_of_ref": "indicator--edb5d23f-855c-4e6d-9274-baedaa217aa5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a658f4-354c-4191-8c44-cc4f31e6f0f3", "sighting_of_ref": "indicator--47b5d07c-3397-43fe-815a-deda40d1af6d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aafdad0-7fd8-450d-ad7d-aa1082e85363", "sighting_of_ref": "indicator--583c416b-92b7-43c9-80ff-5df9f90b1b75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0b0494e-95cc-4d0e-93e4-dab731b57caf", "sighting_of_ref": "indicator--2140ee77-8fef-4e8a-8bd1-ca4f63d6d035", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7302fbf9-b198-485f-8de7-5cb4585e5be0", "sighting_of_ref": "indicator--e801568f-2ef1-41bb-bcd9-c0eebab0572a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--935554dc-a3dd-4350-bab5-bab19a1e8284", "sighting_of_ref": "indicator--1dbea809-dc49-4889-99ae-bb3853e6952a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af0b5471-31fc-41fd-92d4-0636d2f9fb9b", "sighting_of_ref": "indicator--27f4f9ce-b36f-40c9-a85c-7459c7efa0ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--577fd2a5-575f-4e49-91a0-b0cb14957628", "sighting_of_ref": "indicator--a202141a-95dc-49a9-a2a3-fad207038568", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aaf507b-7bf5-4e1f-ae3f-075e5c31c843", "sighting_of_ref": "indicator--5b1ed706-10dc-427f-ab11-fe5a8ced70ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6037a3f2-e724-4c44-a88f-6030b4e22a94", "sighting_of_ref": "indicator--8246158b-bf50-4e62-aee4-4b94a7e11974", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8a2e46-4c1a-4543-a2e5-f51629c1b2d6", "sighting_of_ref": "indicator--229c3f0b-423c-4a4a-9823-df0225dadd27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6278e84-02ae-4dc9-859b-01e72bf0cb82", "sighting_of_ref": "indicator--46fb85e7-f8a6-4362-8489-d9797b79daa6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--026c7642-9565-4846-a311-25bafbffe361", "sighting_of_ref": "indicator--37f4cfb1-8dcf-4709-b4cd-16f86d5d0f7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e1dfaf6-5adc-4385-9bb5-a7d49cce6b9a", "sighting_of_ref": "indicator--1dfa43cb-b3e9-4be8-af87-4b646065f642", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7af5b6-edc6-4741-81c2-d9507bceff46", "sighting_of_ref": "indicator--767f7009-12e6-4907-87a3-1000d1463cb3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44c05e8-5e39-4c06-95eb-46ba30b6e4ea", "sighting_of_ref": "indicator--b074b529-fab4-4ef9-9453-64774efd30a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f010da1-5b1e-4f7f-a421-b5fd032bd113", "sighting_of_ref": "indicator--11ad9332-06c5-4e76-a95d-b64fe75282b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--038ac53c-bcbb-4e29-9d36-a0b0e7355435", "sighting_of_ref": "indicator--79a47bb8-d808-4e8b-a4b9-9c67af4153b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e2e8df-9cf1-460b-a6cc-7e949473c1f6", "sighting_of_ref": "indicator--8bc63caa-b6a9-488f-8abe-323eb410bb70", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1813b82b-05ae-4621-960d-cc3b6c099d2c", "sighting_of_ref": "indicator--6c407d87-e8d1-410d-b021-17f1fa94e73f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4cbed03-0e4f-469e-a63c-8f47623827f4", "sighting_of_ref": "indicator--7d9c8e9c-9cca-4296-8b97-b96a34bec0d7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6311b830-a9ef-4232-a5f4-7b639aa12dc3", "sighting_of_ref": "indicator--cd5fdfb7-c594-4a10-8e33-87325d7f6685", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d2d59ce-23d6-4fd1-967e-5fd248ca35f6", "sighting_of_ref": "indicator--d5dd1c90-5557-426d-9a9a-4c4baf818746", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6266b358-02e1-4a23-9fc9-5dd814af167b", "sighting_of_ref": "indicator--f9e9624c-b5ce-453e-b691-dd5e3d98be4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0e5c09-9687-4d02-8cf0-baeaa0fe59f3", "sighting_of_ref": "indicator--912fd33e-d4f7-43e5-bbd1-05d48aad2475", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a995086-ceba-4666-81e8-14601d52d8b2", "sighting_of_ref": "indicator--a85af0d3-7ddc-4b04-805d-1441317de7fa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c8ffd63-4589-418c-a6bb-65e22d298d8c", "sighting_of_ref": "indicator--79fed304-e2d7-42b9-8e47-81e4d1148ed0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39a9f8b-cbf2-4488-8cfa-408092d7ebdf", "sighting_of_ref": "indicator--9f8cd02e-c764-429d-b89d-07b99a49974e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--966b372f-a1f6-4806-bf01-2ec6ecb7d068", "sighting_of_ref": "indicator--0e8fdcc9-02f5-47c5-a93e-8f07cd41200c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80cbed1-15fb-4cc4-b561-72d14812fdfd", "sighting_of_ref": "indicator--67b799db-d4b0-4e72-8341-2c0c2464a9db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ccbc92-78c1-4ec3-8aae-d438a7e04a16", "sighting_of_ref": "indicator--66e8ee4a-a670-4bec-9e5c-63760f080877", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83735df6-be1e-471e-9dfc-5f803d5a4821", "sighting_of_ref": "indicator--03930a51-31c2-4b66-8d0e-b12b55cf699e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87f3065-1fd1-4a89-8963-c9c06c97255d", "sighting_of_ref": "indicator--7ed436e4-1891-4272-adc1-918178085126", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0421ba96-19bd-4c5e-87d6-fb3b184fe48e", "sighting_of_ref": "indicator--3fc4493e-b427-4f40-9f1b-59769ef9e0a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30b5361-63e1-45ad-be70-8c514eff90f3", "sighting_of_ref": "indicator--3e8821fb-0a6b-4902-8ea6-2f193e98c176", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f52aef25-d869-4560-aece-c8cd907ef052", "sighting_of_ref": "indicator--48f24d32-67f4-48ab-a75a-3ae9d4c67edf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5b424f-760c-4bee-a1e0-0617a3bd122f", "sighting_of_ref": "indicator--5c63449e-2cb9-4b0b-b562-bd19390dc406", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9993347-9480-43d8-81b8-b378df015d4d", "sighting_of_ref": "indicator--5b16d8a6-ef97-4996-838c-cd15ad245907", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de999a19-ae53-41ce-a6a9-4e5c068f0a4e", "sighting_of_ref": "indicator--dd5b9646-8480-4fac-b3fc-15341b2e8276", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2c4c2b8-2f64-43aa-9fc6-59671181bf7e", "sighting_of_ref": "indicator--cd2b25bc-f18f-45d0-9e91-2462705714a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca304fb-f8e4-4054-b71e-48b0ac21997e", "sighting_of_ref": "indicator--a2ae56f1-61c7-4939-b459-f39e9f2802b8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91b76faa-2e00-499c-8776-5ed104607be7", "sighting_of_ref": "indicator--05ee2f52-8a6e-464d-ac5d-a0b3c848a20d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35d6654f-7401-4985-bb19-2c43463981a4", "sighting_of_ref": "indicator--3f9baefb-42ef-442b-b79c-1d225cd16cb7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d093986-2413-4c67-a99f-1d280400045d", "sighting_of_ref": "indicator--6606ebaf-95d7-4226-b4f7-53c54c62bfc9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28927bb7-2d1c-49f2-934d-4bdf8bd86082", "sighting_of_ref": "indicator--b0b9b4fb-7d2c-4c82-802c-1161a75145c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--addeea6f-269e-4f90-b4d0-2ee4c4895bf5", "sighting_of_ref": "indicator--08eab18e-3cad-4399-8f62-1d209cc1219b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50b70c29-3f0a-4bca-a4cc-7640f8bdd9a4", "sighting_of_ref": "indicator--c4810512-a07d-4fc9-976c-cd2b1bf7d981", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42e005a-3514-4944-81ba-be86bfaf4d4c", "sighting_of_ref": "indicator--a29c5df7-7095-4ff8-9480-246a3fac3e24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea40645-0f30-4871-b2b3-87faaf785e3c", "sighting_of_ref": "indicator--0c6bdf50-b4e2-46f5-bc88-c0c232a7849d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8b88a2d-b833-4eab-a3ed-7d9ec8df5bdc", "sighting_of_ref": "indicator--c017f8f7-ae59-427c-a030-433d59fc804d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b1020bb-b3eb-42a9-b101-1690022cf0e6", "sighting_of_ref": "indicator--7945b44a-6d0e-4a76-98c0-8a48463cca7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ebe33f1-e1d9-45cd-af30-8ebd2e6a0dd2", "sighting_of_ref": "indicator--3d78bb56-bb9c-44f3-a2a8-131bb3b25c29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f0786a3-bd7a-4e04-89e0-7ecec7ee12a0", "sighting_of_ref": "indicator--e53b71db-d5e7-4ca2-9b52-ed59d6b8730d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7248fcf3-f159-4dc2-8da2-ad3ae8766e4b", "sighting_of_ref": "indicator--5e7f650f-ff88-49d1-989d-db6b14e9babc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e5854c8-0529-4a5a-82e2-e704e0af618d", "sighting_of_ref": "indicator--cdbea67f-a19c-495d-8264-62111d51c22e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60259669-847b-47ae-97ed-20695fcb8e4a", "sighting_of_ref": "indicator--3dc39ae1-79d2-4106-b783-d700040b01c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3acb63d4-c1f0-4fe7-8f36-ee64c08a0b44", "sighting_of_ref": "indicator--9d0d83de-05e0-4509-8d68-eb6226636afd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9dd2705-b644-4e34-8f89-e50ccd040e74", "sighting_of_ref": "indicator--2513280c-c556-4784-9379-a985c282460c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce14f1ea-6875-40e4-b485-d699dbb3c7e7", "sighting_of_ref": "indicator--ddfad475-9f3f-4e7a-b34a-397df8772ec1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86ffd85e-4580-4004-92f0-e9bb8a668797", "sighting_of_ref": "indicator--62fa900b-0d5c-4201-bc92-dd7545a2daf4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c76986-54eb-43d3-81a3-1c6f0c357ac9", "sighting_of_ref": "indicator--f1d3edad-aca0-4a58-886a-01d31b0ff829", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b066b501-2d12-4c19-b9b5-f4401af17a81", "sighting_of_ref": "indicator--eaa88d65-adfd-434c-ad76-8148f5fd66c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f150bfd-64b0-4caa-94fb-ea2b504491a9", "sighting_of_ref": "indicator--92158a7a-b421-4e59-b275-7681dd3f31d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8523049-9081-48e8-9116-b4e23a004040", "sighting_of_ref": "indicator--38144fcc-daa1-4136-bfcb-f9e0f82c7c25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--184f2320-1041-47d2-9f6b-478836f8e8d4", "sighting_of_ref": "indicator--f98a58d6-6173-4157-af6b-d7ab9a23a631", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16c70f3e-4eb0-43c7-8a6f-941c77336282", "sighting_of_ref": "indicator--55c8f1f6-7594-49b3-bd83-696e18aaf762", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85a1e894-00ed-4268-9893-8a7aa895d796", "sighting_of_ref": "indicator--b80431b9-fde9-49a0-8860-67e27042e63d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d926f16-a559-4523-a0a9-f3dc10eb9a2e", "sighting_of_ref": "indicator--1643676e-b068-4733-9292-44311857bc7d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d739d5bf-fa05-4ed1-b018-40fd0eae709c", "sighting_of_ref": "indicator--851a4973-455c-42dc-97e9-a0b251bf0c68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b736de89-3387-4c9d-8fd0-b63dd8844af6", "sighting_of_ref": "indicator--18b85551-0978-432f-8146-20a04005e2a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c60d3ae-73e1-443b-aab1-da7c0806dd41", "sighting_of_ref": "indicator--1d31fcc5-daeb-4c7b-b50a-c0beb45ec199", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7e3d758-4f5a-492d-9dcb-9c69511864df", "sighting_of_ref": "indicator--8004fc0e-4a21-4570-95b1-5ec8501dbd8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64a9db78-084b-4d80-b68f-d99f23c98ffd", "sighting_of_ref": "indicator--ed1ecdfc-5711-4c37-8c38-908cefe5442e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d03348f4-a1ed-42d6-8d60-d709468ff378", "sighting_of_ref": "indicator--806be357-e775-4ce9-8ae5-8975921eca1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22ce050b-93d8-4c22-a065-3dee2245a7e8", "sighting_of_ref": "indicator--5cacf7d0-7670-43dc-88f1-aa692eb24531", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70872e1c-c516-4a21-bc2d-54305a20b016", "sighting_of_ref": "indicator--14561081-fc5a-4549-8eef-3ba7432246ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--309da256-9e90-4000-8f72-29ef9f4eadc9", "sighting_of_ref": "indicator--8a5d06be-0ee2-4367-b185-e7800be52d73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d8e19a-c92e-4db8-88f2-a04d68287791", "sighting_of_ref": "indicator--7359dbce-7c8d-42ad-8c98-3fd75fb28736", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446d73e2-9ef4-4e75-a613-506d030de3c0", "sighting_of_ref": "indicator--586bdd05-92a0-4b5e-b1d5-986e90d956c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad104e5-30bc-4275-b6cf-eec13ac84cb2", "sighting_of_ref": "indicator--4abadc17-c237-4acb-b268-ed7a483ac327", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09d790b1-9d8d-40f4-a2c7-1c07f9c2c45e", "sighting_of_ref": "indicator--bbfcb687-a716-4eb2-aa61-fcf19c7be2ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddff6ed7-c59c-405a-a302-61bde64c5dec", "sighting_of_ref": "indicator--d0412a57-e6b4-46a2-bbaa-acbe0d3ba3aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ca44fd0-ace5-4f7f-aabe-930ab10c3e01", "sighting_of_ref": "indicator--af23aec5-ecad-43d1-af37-2f861b204cb3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0e074f3-bbb9-45ed-b96c-0d6c854c8bc7", "sighting_of_ref": "indicator--361b0d78-3d04-42f6-8325-28ede0181bda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f9ba18d-b4cb-4522-9d1d-4f025e223770", "sighting_of_ref": "indicator--1e5e4f4e-8538-4105-bc1f-f7ac452f9228", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1e38621-5454-46a7-bdb2-81848f746ade", "sighting_of_ref": "indicator--6fd6d063-fa82-40d8-b99a-b4997b0b3f8c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab18d7bf-9ff2-4024-9494-705fd567bba5", "sighting_of_ref": "indicator--aa1e05fa-fe6f-4db5-bac7-9d67e4027a39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b88901ab-e1d6-43ca-8168-7d30421e704a", "sighting_of_ref": "indicator--bb00a627-2306-4192-9140-9fcad3ca6175", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84ca6f63-7a66-437d-bc74-28efc44f68a5", "sighting_of_ref": "indicator--e58c0e0c-7eb3-4f90-aea8-99fd5d481741", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86528707-a7ad-4432-813e-7d146fb106af", "sighting_of_ref": "indicator--6884a319-4bd6-4838-8140-d0d04e436f70", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5237fd0e-2e5f-4a63-a8e0-a1bfd84f94d7", "sighting_of_ref": "indicator--7c817d2e-e460-40c1-8cfd-af5e07e55f22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c574b7-2d8b-475b-8986-b053999470af", "sighting_of_ref": "indicator--07ec5f56-d2cb-4019-9fe8-6553323dc295", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344bb910-9047-4981-8548-af975983e65e", "sighting_of_ref": "indicator--1f6addaa-11bb-47f2-b6d0-88e294c20e61", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d24b93fd-e534-4112-8d34-dc7964e75c28", "sighting_of_ref": "indicator--b50689f6-4605-4521-8ace-4cc72bef0d0e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b08fe58-5ead-4a63-b045-0f942d405b99", "sighting_of_ref": "indicator--9749b5a2-052f-48b8-b1c3-4124a0652f5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baa22d63-430f-4a43-b9cd-29deceed9874", "sighting_of_ref": "indicator--10d19428-0800-4477-b3aa-524f6f7fe5c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e29bc2d1-17c8-439c-9fde-35566687f543", "sighting_of_ref": "indicator--84ca003e-d48e-4817-a95f-52b9d339b993", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcd42f5f-dcfa-475f-9d65-ee1fb982bd66", "sighting_of_ref": "indicator--1eb35868-a310-4ec4-9954-07df3929aa4f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5441b924-fb23-409b-ad5a-4920fa19451e", "sighting_of_ref": "indicator--0c3bc337-bc69-4347-ba13-43ddd1ca5318", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4af8446-587a-4f36-91ee-e339fa546f16", "sighting_of_ref": "indicator--4ff0eeff-729f-4ed7-a3a4-ec93daa6f754", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f83840-49b3-4a16-93bb-55601b36c2fe", "sighting_of_ref": "indicator--0867aade-1884-4395-b543-d3e338b0a230", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb18e4c-4103-4428-87f8-4be08bc6310e", "sighting_of_ref": "indicator--a0ec9c16-6af9-4c3b-894a-8a0230b47ee0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb135f24-3cf9-40c7-948d-cf9c4ec2e954", "sighting_of_ref": "indicator--1f8d745a-8398-4fce-8d06-4cd80f494cdf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--069d747e-eaf4-4698-8436-7c50a8e26f34", "sighting_of_ref": "indicator--fad3d463-13bf-41fc-97ea-b029a3d68428", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c13347ad-c3e9-4fe7-a6e2-709c7fae30ea", "sighting_of_ref": "indicator--61a74c78-69c8-4423-8887-dcc8c503aebc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbc23c57-9b75-416c-9a1b-42ed62c00d0b", "sighting_of_ref": "indicator--87cfadb0-410e-473f-a734-6f9dcc1fe1c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1785b82-0a79-4c00-99f1-7afc7b351ae1", "sighting_of_ref": "indicator--d9181b9e-f499-4769-96b9-08fe9e822d5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e29f027-9cac-426b-9e29-200a371f69ec", "sighting_of_ref": "indicator--4655457f-4aa9-4ff1-96a4-3844d0e49b66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96618c3a-3c81-4176-ac81-b9b6b86c020a", "sighting_of_ref": "indicator--d0460e0c-3b03-4a00-9786-5322f1e82150", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2c611f2-5f02-4c93-8f8d-f7d4b17ac3db", "sighting_of_ref": "indicator--b0349ea5-5095-429e-9361-cb04fc155663", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffbaeaff-01ac-4e4e-9838-51908e3bda4d", "sighting_of_ref": "indicator--26f9084f-c69c-4b11-98eb-8a8d822d14a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3aee6f2a-e655-4e69-b518-41abcdb4c19c", "sighting_of_ref": "indicator--acb445b3-88a0-44e0-b798-2b5e01d30271", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--225ba6fb-2e87-4c46-8b7b-23f7c281f880", "sighting_of_ref": "indicator--b94c22ab-a52b-44c0-a1e8-db0d6621f9c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6d93808-0e62-42ab-979f-46f4da9e5be5", "sighting_of_ref": "indicator--b424489d-150f-43d3-b78a-19e64f978404", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1853b3b-35ff-4153-8980-1bd797e4ac49", "sighting_of_ref": "indicator--c9df4ec5-5113-43bf-9c31-6fa1b65a546d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f952793-2308-4120-9a35-b9adff446fd7", "sighting_of_ref": "indicator--cde22f7f-3e8f-49a8-9ff7-4fe35a463ce1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d6eca9c-6198-4549-96b5-c3b3d5b483c0", "sighting_of_ref": "indicator--e2e3d0f2-25cb-4d36-acde-406412c7f8e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--139e1afe-78af-4e7c-ac33-ffda1f9f5385", "sighting_of_ref": "indicator--cc53c785-9107-49e4-97f9-5b59675b796a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--168b1d17-a03c-4b37-9402-900d4f2e854c", "sighting_of_ref": "indicator--e2bbe6bd-262a-42eb-9976-bca95d5a00fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccfa949b-17ac-4248-b639-0018d99f5854", "sighting_of_ref": "indicator--f44db021-849d-44f2-9f21-7f4dbcc6ce30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16b40a6-b836-4f53-8aee-1f40066b4b94", "sighting_of_ref": "indicator--3d510a6f-8c45-4f8d-8a79-e5d7736bce11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5cfd28a-837c-4501-a59d-e8312071e8e5", "sighting_of_ref": "indicator--376a7014-79d0-4608-99fa-f09346cec50f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c52813e4-8199-4ff4-9419-c927ffef0e33", "sighting_of_ref": "indicator--feee65ee-34d0-4bcb-ade8-431a97781a63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb88e58-56c4-4ead-8b9b-e4819a9bded7", "sighting_of_ref": "indicator--73a8be66-b7bc-42ee-a876-7c2e8f40172f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246d5392-2efe-4f29-ba47-1e6d9ab81629", "sighting_of_ref": "indicator--f558878e-6081-4d88-92e7-297b2fc8911c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2f9c212-0920-4349-9f90-14983c42c4b2", "sighting_of_ref": "indicator--20072565-2b6a-4076-8f07-a5845fa9a376", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5e3f323-8959-49eb-a69c-c5a2caaf16bb", "sighting_of_ref": "indicator--b2449fd0-16b4-4100-a251-8ab8932822df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dbca557-f855-4d6f-8eca-aafce6c086a0", "sighting_of_ref": "indicator--acee6e6e-e3ed-4b0e-92bf-a79ca557fb9a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bca933d6-0ada-419a-bd3d-ca8d578c3872", "sighting_of_ref": "indicator--37d1ec8b-46be-49a7-b1da-15e75aa5e39e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6309fdd3-b4ad-44c7-ae2b-e6d7b059a35e", "sighting_of_ref": "indicator--61e2c49f-6e11-4713-a1c5-68092b8ed36b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebde868a-1535-41c3-bff8-ed00571ffc3f", "sighting_of_ref": "indicator--e5ae32b5-8ac8-467c-822a-1482480534a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9752f80-483a-4e63-be11-3635fbe879ff", "sighting_of_ref": "indicator--d685f8b8-daa9-4112-8f44-4f7f1963bac9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580d195d-eae7-4b57-9bb6-2b4174f95948", "sighting_of_ref": "indicator--fec7abd6-81b9-4fc3-b052-4c1eb133864b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--444ce0db-543b-4be6-b716-31a423e16b5a", "sighting_of_ref": "indicator--d1a421a8-d606-4909-9bad-2bf4cf67662c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb773be6-833e-41f8-8451-dd215543ed3f", "sighting_of_ref": "indicator--5c558920-6166-4dae-8d22-eea345284751", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--630f9980-5d6b-4059-b19b-98fcce6d05b6", "sighting_of_ref": "indicator--17e0bac1-af92-4f0d-b7ba-e3ba40d14882", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fbc1ccf-4643-4c22-882f-5f054d62981f", "sighting_of_ref": "indicator--44aa0c98-f7a6-4a3d-8580-28595d39d421", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce81daf3-3fd6-4b15-8066-e00158930b58", "sighting_of_ref": "indicator--c0a92da9-ca13-4ddf-917f-57a326172c11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0990ba22-a4ae-465d-983a-a65cb70032d7", "sighting_of_ref": "indicator--36c80c83-a8eb-4d19-acd1-a88ceb5a8d8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e3b142-950e-4d86-9948-d1bc7ef1e344", "sighting_of_ref": "indicator--8f7c832e-2b08-4fa8-9580-f3d6c0496748", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1ef373c-5700-4fb1-8075-1bb74b2fb741", "sighting_of_ref": "indicator--252f4bfb-dd98-400b-a2ac-89011949142a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0387bfb-30b5-41fe-b6c3-18325c5583a4", "sighting_of_ref": "indicator--3705e1c4-0f25-4b0c-bd2e-52ef271c7a35", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f44a10b3-1b79-4b6b-8e52-bd16d09875ed", "sighting_of_ref": "indicator--70641b23-2deb-4941-aa8d-dd598e5bacc5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--392a722c-f1f6-4dfe-9f5e-8f04230dbad9", "sighting_of_ref": "indicator--d53af3dc-6f73-4d49-9620-f067163d372b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09ee13ac-c35d-4775-b3f5-d3720924608a", "sighting_of_ref": "indicator--3e5bb95c-945f-4c03-8a4a-391d514d381c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fac6054-ae41-4fb2-b2b0-edd5dc6d986e", "sighting_of_ref": "indicator--762b7fb1-2d3f-441f-bf14-4971057880e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39fa08c-5569-45d4-a9e8-af637713b5e6", "sighting_of_ref": "indicator--6cce9664-1140-4e8d-ad53-b5acdde4d863", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01585ce-9cd6-4e24-969a-ff36d791658c", "sighting_of_ref": "indicator--096dd418-da51-4796-9092-74b01710006e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39dd582e-84fe-4b49-9d35-cb92b6e2874b", "sighting_of_ref": "indicator--c0d8ce7b-a269-47cd-8bc9-35c3fe097e3d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a01eccaa-4e63-466b-8eea-9d1865e700ad", "sighting_of_ref": "indicator--a26be2f8-5793-4360-a7f9-6527dea8f934", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33a5d400-8a79-49ee-96a7-158cade913c2", "sighting_of_ref": "indicator--68fc7b03-7ed1-49b7-99bf-5fcb3c484105", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7eef0a3-25f0-48dc-8501-72e85f5e9001", "sighting_of_ref": "indicator--5aca479a-6a9d-46eb-904e-60d8a172902f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77ba0be3-0727-4cbe-b869-2656b9800bf9", "sighting_of_ref": "indicator--caf38b3e-4d45-437e-a367-eb2a5ac0f35d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217dedd2-f492-4281-b023-faa0136658d6", "sighting_of_ref": "indicator--03efa5b3-7208-4950-9066-c30dbf67db3f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2eb1bc4-3389-48c2-932b-496233667a54", "sighting_of_ref": "indicator--5ee550ca-5016-4f8b-822f-5167e0e9e4aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa8c706c-5492-4c06-b374-5b3f21b077f9", "sighting_of_ref": "indicator--fd61e53b-204d-45a7-8831-86600ba8d4c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2974880d-33ad-45b5-97a4-4c48f928d8ff", "sighting_of_ref": "indicator--c9942695-c9ab-4d92-a04d-ec68b908fff8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c2b970c-6829-48fe-96b2-95b7174ceddc", "sighting_of_ref": "indicator--e77ade0b-f6b5-44bd-b023-7d79ed45e898", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7210111-7381-4f23-949e-2a123be0d988", "sighting_of_ref": "indicator--32363096-58cc-4b9f-891f-67ce49a5b77e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77e1e306-5010-4d8c-b3f0-23a868c0ad9e", "sighting_of_ref": "indicator--abaa2d50-020d-419c-a9d6-0aa67daa1504", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc0fc3f1-3ab4-46a7-b7dc-9fcaeea1ece0", "sighting_of_ref": "indicator--46d7dc21-6b8d-4dc8-a54a-d4f6c1644db6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6312608-c815-4f94-8c1c-3804a7bae42b", "sighting_of_ref": "indicator--8eaf4e86-9fef-443a-88d2-d4c2ddb94848", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a70832d-2a5f-4f13-ae8b-4928c9004c5b", "sighting_of_ref": "indicator--e7fafcf5-8655-461d-bde0-157343b4ff8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a075e24f-e3f6-4526-90d7-30766477391c", "sighting_of_ref": "indicator--41940590-c3b4-4179-9963-f2c753926adf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--878c1c86-fcd2-4c8e-91aa-fd0fa4f94265", "sighting_of_ref": "indicator--7376f9e1-70be-4d41-a281-db7ac92cd3d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21c49c8a-ba33-4250-8def-fa8add442be0", "sighting_of_ref": "indicator--8f29ffa7-362f-4b9f-bc80-037c0d76a7aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5bcc6bd-4c02-4dd9-a20b-7cdfd2180558", "sighting_of_ref": "indicator--f7747851-e86a-4699-aa47-61efaceea3a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9419cb2-6b90-428a-8996-070ae9446948", "sighting_of_ref": "indicator--6e2e3ee5-434e-4cef-8fd4-aeb39c60e6f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f0b9032-bb5b-47ab-88cc-12db55511e84", "sighting_of_ref": "indicator--4c255535-dd58-4c1c-a612-4c049619ec30", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce3562fb-4a20-4cb8-b0b2-4f1822f47eae", "sighting_of_ref": "indicator--1879e18e-4e56-48ba-b3b5-acf52400d3bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94d373d0-f6a7-424c-9846-1f8f499639cc", "sighting_of_ref": "indicator--ab427e36-5873-4ef8-9b40-339df683dcc3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b475502c-ea4b-47c1-9596-0b201b5da0e5", "sighting_of_ref": "indicator--ab427e36-5873-4ef8-9b40-339df683dcc3", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ddf134b-c18f-40a0-bd68-e051f520286e", "sighting_of_ref": "indicator--3882de03-4bd5-4580-a64c-5d4321a3b0c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b979ef0-c1c6-415c-9bec-d371db42a6dc", "sighting_of_ref": "indicator--591e0b4e-3a1b-462e-8012-caa469587ff6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2965f817-8b14-47ff-8238-4ce41d01075c", "sighting_of_ref": "indicator--182689bf-2793-4cd3-b993-862c86e6c7fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e9aa05-3a9c-4685-a67b-6e5ea283241f", "sighting_of_ref": "indicator--601ec60e-9c4a-4120-9b53-f84ef175362f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62e70a5f-1dc4-44f8-b183-e2e0b5f24d66", "sighting_of_ref": "indicator--9bb49f21-3287-4614-9f3c-aa06b441400c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe5dc68d-9543-4056-bec3-d26ef0eb4446", "sighting_of_ref": "indicator--1bb85971-d827-4eee-a511-e861435ca91e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06e9dcee-e7f3-4d75-b8c8-ae2c9489d140", "sighting_of_ref": "indicator--5fd67fb9-5f17-4458-8614-10ff0fd2e3da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c75d72-b5e0-41c2-93e7-c34591f68063", "sighting_of_ref": "indicator--0c9c2d86-c9c0-4aa0-8f66-99895cd86cc5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--950b68e5-0553-454d-92f3-73c0eb05f5f9", "sighting_of_ref": "indicator--8aa35c14-ba40-4a41-b5eb-5b0954c81b3e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9ea207d-507e-491a-9513-4baee3e6fa1b", "sighting_of_ref": "indicator--43551ee5-5aee-4bee-b398-1c80ab9fa577", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f010dad2-bc3d-47cd-8f7a-3c2173792d2d", "sighting_of_ref": "indicator--96f472f7-66d3-4c72-bd54-84724ab51da0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2087167e-b07f-4518-94e9-3ec433d7f76d", "sighting_of_ref": "indicator--14925e7b-76e9-43b8-8d03-9c570ea1b513", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f21908-d649-46ac-80d8-5a63eb539b67", "sighting_of_ref": "indicator--eb1e8276-377c-40e7-ba35-ed7a877f53d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48c9a9ea-6826-458f-8157-75ac26317193", "sighting_of_ref": "indicator--cac889f4-6ddd-49f9-a482-d1c15ee1a821", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6af53df-9df3-4b5b-8537-3e696125e0bc", "sighting_of_ref": "indicator--0030c2db-bae3-4ed3-a4d6-b3fc2738ee4f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26ff91fa-51bf-495d-abda-526faaf0e428", "sighting_of_ref": "indicator--773d94aa-9a11-4ccc-9a89-90d9179c5413", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--150eb0d6-3371-4dd1-9d06-90088b008ab4", "sighting_of_ref": "indicator--9080458c-24be-4a44-b5ec-8f68bccdbdb1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--246592f6-b10b-4904-b333-cf9547cbfae1", "sighting_of_ref": "indicator--d84285af-cde3-486f-876a-b835ea6e7ed8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a41d9c54-86cd-4c0c-935e-04673636a155", "sighting_of_ref": "indicator--8cb9199c-ea47-4b89-b253-c15f0e259cab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d8924d2-9e64-453a-8356-7c5967d6676a", "sighting_of_ref": "indicator--8c3c4d95-8389-4a0d-965d-9250fc7aff62", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32b17104-1c8b-4260-a931-a924befdffcd", "sighting_of_ref": "indicator--816fda77-bb13-4e5d-b2dc-c1d2c102af8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f90086eb-d007-4ae7-a4be-95401fce895a", "sighting_of_ref": "indicator--fef51335-bcca-4068-b73f-22d97598fc77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a397e919-0ec0-4bc9-919e-c17b9909ee48", "sighting_of_ref": "indicator--8db3cfda-81c3-4a98-8f59-586d929f40b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f47c3675-e353-4de4-8610-39ca9121e687", "sighting_of_ref": "indicator--e14e87dc-12d9-426f-ab7c-1fd6caac6d7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4827d542-501a-4917-8331-865cfc68dd9e", "sighting_of_ref": "indicator--58e37891-feb7-434c-bddf-c1c98a3edafa", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e91667b5-976f-4511-8a81-941dd863a857", "sighting_of_ref": "indicator--b1ed4c75-577d-4ccf-9836-fcce5c5378c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ab21049-2422-4d31-8ca8-223541b09f8e", "sighting_of_ref": "indicator--15834d3b-db8d-455b-b642-ab63447fb4fd", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aee5b12-694e-4642-ab1c-1b041cd58253", "sighting_of_ref": "indicator--f7964395-3806-4457-8112-8641eb42477d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2345e6e-7c10-466a-8523-5279e2af2fd7", "sighting_of_ref": "indicator--e00d3854-d730-47a3-af21-0dac11ff8226", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0ee1c9-2251-47fa-89dd-831d05c22a74", "sighting_of_ref": "indicator--ffea8d9e-7e1e-47d2-aece-8e1c34f72134", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--457b95f2-579e-4102-bf9a-23cf3caec1a1", "sighting_of_ref": "indicator--a3503ccb-d9c6-4309-824f-814196d23558", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee38a76c-0763-4767-b3c4-4a9d189e5705", "sighting_of_ref": "indicator--3842d573-ec83-4769-975b-0caecd29ff63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--735f1da3-f48c-4df8-be99-28587d245421", "sighting_of_ref": "indicator--77a6c7f3-ade8-4bfd-b7bc-933502b23a2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9d1b90a-3e3f-4768-a097-69870a725962", "sighting_of_ref": "indicator--76f22aed-f522-4164-95fe-2aa330ba6627", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87fbe9eb-1708-4890-bf1c-b7c0e2dc99d4", "sighting_of_ref": "indicator--e55ea0e6-e996-473f-8af0-ced15d37d8f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba0f8980-5765-49f7-9178-c11ff4facbd7", "sighting_of_ref": "indicator--b61ffa1b-e8f9-4fcb-b47e-441db315b79f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa3efdb-faee-431e-bd07-a094de8e69e7", "sighting_of_ref": "indicator--a0ce732d-80ac-4ef1-a9da-e9f423a1038b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9639d84f-1cf8-4c11-9c1d-ca90e64bbb74", "sighting_of_ref": "indicator--93755f9e-4112-4aa1-962e-07bb308adea3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--444ae1e2-a9ec-4989-afc2-65eb8592bc82", "sighting_of_ref": "indicator--dbcc97f0-5428-4df0-ba0b-a924b5cb1bce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--431edb24-621f-42f5-9b96-d463093f20f5", "sighting_of_ref": "indicator--c99d27d0-6d01-4013-b38e-fe375495f456", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--768310af-8d86-466c-9f9e-4a764435c486", "sighting_of_ref": "indicator--b7a6212c-a7e4-49b4-a82e-83fe9ef12c60", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--443611f4-8433-4aed-ac5c-092505f92532", "sighting_of_ref": "indicator--da2cf5c9-b39e-4df7-9a1e-e0eaac123457", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5938d08-c317-4a26-a136-450bb864aa25", "sighting_of_ref": "indicator--b5c0a304-ffe2-43f5-8131-30cced18fcec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11a49ce-0ea5-495a-af57-e67d2adbf72d", "sighting_of_ref": "indicator--57c32e01-313b-4a4a-8eec-27024c55a643", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9663136b-b87f-4c0a-b62b-d6e6a7e14539", "sighting_of_ref": "indicator--9786a8dc-e501-45ae-ab98-214d1096e066", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--889cba84-cc0b-4a85-8ead-7686910288b5", "sighting_of_ref": "indicator--a72021f7-eb6c-4824-9067-67ba0828e5ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3637bea1-76ff-46b3-91a6-772c838eb43e", "sighting_of_ref": "indicator--237e525a-ddf2-4a44-a720-2eee8cca12f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9eb316a-deee-4744-9723-76e3f4abe72b", "sighting_of_ref": "indicator--6f28e6d2-9f46-4d5e-b856-bfc263f96f42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4857559-e0dd-4842-96f9-08b87a4e69d1", "sighting_of_ref": "indicator--ba03a1f0-d3fb-4eb7-bb9b-73e596806eb2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c360cd-8261-4af5-9d42-4209365ec269", "sighting_of_ref": "indicator--f9dda6db-b4ed-4bff-b9b5-5ccb1a2efda5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b440340-97a7-40aa-8c52-c03de2e1f842", "sighting_of_ref": "indicator--8541f9d5-af08-4078-9221-ceb778fd2b55", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf76675f-0a6c-4821-a569-2dea2597c8bb", "sighting_of_ref": "indicator--de0da111-d190-4e7f-b9fd-92d2505a0b30", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f70e67a-0844-4efa-bd3f-cacc74f02294", "sighting_of_ref": "indicator--67d91e7a-eb36-47e4-b1db-fb9f76231816", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--621494df-06ea-4f0a-aabb-f526c050295e", "sighting_of_ref": "indicator--4c5a7b3e-a51c-42f4-bb5d-4cbb625ef11c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a36c7a7d-911d-441f-bc5f-9c0384c0caef", "sighting_of_ref": "indicator--8daaf89f-437a-4fe4-a530-63139d485e32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d22b7fc-bd65-475a-ab74-a54d08f1f0c5", "sighting_of_ref": "indicator--567eec96-a1c5-4eca-9ae9-268acc7de474", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e88ebb3-acd0-4317-a42a-1faddae94a01", "sighting_of_ref": "indicator--134354b1-3fbb-48bd-b2bc-1c5423fbc19a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fda6354-a40c-4e9f-bee8-d5bc5ae13f89", "sighting_of_ref": "indicator--206385e5-3319-45ad-b5a0-ea1af7b58493", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c826490-b4d0-429c-9bb5-57d7ce4031c0", "sighting_of_ref": "indicator--2b307bc8-d76d-401e-b0c7-684e03d2f350", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a910030c-8117-4462-aba3-00fd17868bed", "sighting_of_ref": "indicator--8283aaf0-1ca5-4b35-b00f-1b7c0883a074", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a91e0ba0-b0d2-4cdb-8324-ab380d4f5b57", "sighting_of_ref": "indicator--d89484ee-82a0-4263-9102-414eedfef203", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--998aa5d1-d07d-4314-93d1-4481614fda9d", "sighting_of_ref": "indicator--220ccc61-b883-419c-9842-c5bd073b3eed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e99563a-8457-481b-a66c-f5f083f2845c", "sighting_of_ref": "indicator--d32b48e6-a275-4ce3-9ef7-32fb268b169e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a660ff56-4e15-42fd-ab02-6a75f8e31ffa", "sighting_of_ref": "indicator--855f015a-2d24-4ae0-8b86-b38c23a6bf21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b675536-f504-4262-a490-4b85de7d7846", "sighting_of_ref": "indicator--5185d186-2b2e-47b1-b1aa-4852f986260c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ad195b-e352-437a-945f-e065476d80ac", "sighting_of_ref": "indicator--984e1570-758b-42fc-a5ac-af780e52fbeb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b716342-9dd4-475e-b360-dce159759e4f", "sighting_of_ref": "indicator--b91218ff-467b-4112-bb9c-de3581511ac7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11139960-d4ed-4e12-a448-c02e54d04807", "sighting_of_ref": "indicator--9341d640-00a0-412c-9c2b-48dab7af9275", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452036c4-4c55-4e5d-9cbc-408009f806e9", "sighting_of_ref": "indicator--28c88a9c-5cb6-4a16-bead-e8e207c63b38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2a5fe5-afd7-45df-b24d-b381c8bc88ab", "sighting_of_ref": "indicator--42536166-cacc-4e20-90a0-424089674922", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee816ae-6ad5-4a64-8c7b-7bd05456821e", "sighting_of_ref": "indicator--7e6b9394-4e45-44a6-8d9b-6ca65cc779b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70ed0aab-9c89-4df4-9301-ffbfc340d71c", "sighting_of_ref": "indicator--3fc3b6ae-24c8-4209-b4c9-1f98bbcaa8a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c9ba308-84ba-4de1-bb81-2d631e413482", "sighting_of_ref": "indicator--cd1dbc6a-e499-48f9-9bee-392697b9b996", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce0f091-9eba-42ee-9847-0710abb3e086", "sighting_of_ref": "indicator--b24744f3-967e-49b4-baf3-eb19c61b08a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5224dcb-9157-4a74-b3c1-d57194a258a0", "sighting_of_ref": "indicator--988695b1-9a48-423f-8c18-9b518127788e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdca2545-4d69-43d4-8eaf-a3566e43ee2b", "sighting_of_ref": "indicator--171d80ea-3691-426f-bb42-9293e04cdc4b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32567070-738e-47ed-a81b-2f2e726e68a9", "sighting_of_ref": "indicator--7d88cfac-72d6-4cd8-8450-fa6c93b206f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b587fce2-3f5f-4d63-8eb0-b925f814adda", "sighting_of_ref": "indicator--6ad7186a-5d45-4bb6-82b9-57292b28cb77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d350f1-1ca5-45cf-a034-00f88cf271d8", "sighting_of_ref": "indicator--02523104-692d-476b-877d-a489595913e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2354a0c1-11d6-408b-825e-b93e9e5f6551", "sighting_of_ref": "indicator--4c612e54-9c47-40f8-ab27-5a4702725a7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2980e10e-5834-4aed-b076-ab67b109dc9c", "sighting_of_ref": "indicator--9a077026-670a-4b24-bbc4-0d7d43c88aeb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf69e318-2f5a-4e6d-9a18-042093c3f299", "sighting_of_ref": "indicator--d703e249-d856-4557-8e29-d736533729a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2a237b-13da-4cc0-b13c-6aff3e8b65c0", "sighting_of_ref": "indicator--59c454da-aad8-448a-aadf-98134d3cfba3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4eafada-250d-4e09-b7eb-e0028d00241b", "sighting_of_ref": "indicator--9444c78f-5e59-45e3-ada2-97ad6a566e42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--964a8234-6ebf-4744-aa20-23a3fb216af0", "sighting_of_ref": "indicator--957f7355-1045-4731-be70-c9cfc7a5a15b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ceff36-741b-4a62-93d5-98c27993e17a", "sighting_of_ref": "indicator--c2a67ad5-28b0-46e0-a4a3-10bdae2dbe07", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3f965f2-1c44-41ba-bfad-210f8365125b", "sighting_of_ref": "indicator--979b46c1-d5c5-453a-9560-835a4611d798", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cedfce49-948c-49cc-8fdd-0355158fdb5f", "sighting_of_ref": "indicator--59c09794-4d01-4454-93fb-22c8aa7fb17b", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19ba784-358a-404d-be5a-2c1d946c6284", "sighting_of_ref": "indicator--70777da3-79e6-4021-aed7-bb7c93dcf78b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f8c8e7e-4e60-4a89-b451-41e7f205dfbb", "sighting_of_ref": "indicator--c9c5b739-3e41-4f77-8867-f4a7caa846d2", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db558cc5-e1f6-4f66-80ff-817809f028db", "sighting_of_ref": "indicator--f784ba61-2bfc-49e5-8497-09f09862eb3e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4029d33-b23d-46e5-bfe4-3f7ef712c205", "sighting_of_ref": "indicator--defbef61-2f2e-48aa-9e28-722f432fcb77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eada5c4c-4355-476b-9c3d-ac7d67d72cd2", "sighting_of_ref": "indicator--0d3a5af4-2237-4b15-9710-d022d3bd065a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26c4c21c-cdcd-498b-b125-a827d8a9eea2", "sighting_of_ref": "indicator--2825ab7e-72bc-46d0-8bde-26ea51f21e30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8ea55cd-1ba3-46cc-8757-8ec196678fb9", "sighting_of_ref": "indicator--9df263e3-9a4c-42c3-8a31-f7926f9ab810", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--213e6860-841d-4d62-9ec1-e8874fb762cc", "sighting_of_ref": "indicator--63afeeea-fb91-4808-8f24-54b62a7464c3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc6c1bcf-abd1-4949-aef1-52e622ed78b1", "sighting_of_ref": "indicator--b9abceee-2e80-4350-ba0a-ce8a4ee468a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ba75275-735b-457e-a716-f803bf9e3a2c", "sighting_of_ref": "indicator--cb8cffe8-a261-4022-b7df-e8d6a536a7d1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02e2350b-db05-4653-9f03-bfba10a92273", "sighting_of_ref": "indicator--0eaa8f6f-69ca-46b8-8d21-20fb5be49e43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64ceea5c-8d9d-4081-bcde-2559c870c281", "sighting_of_ref": "indicator--fa4d2274-916c-4e28-a054-edd9742a97b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb1b25c3-02a6-45ab-a9dc-829e617daba8", "sighting_of_ref": "indicator--452871e9-a97c-4941-a966-6f39065c2ddb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--489bebe3-d0e4-459a-9aa7-eb9a300f5d1d", "sighting_of_ref": "indicator--bcc4d183-fa9c-4a07-82cf-7332144c1925", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2919677d-db5b-4815-ba75-8096ec3109f9", "sighting_of_ref": "indicator--db74bb74-90ca-4203-9cbf-5502ab5c2aec", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd3b9494-96c9-4920-b35a-6a922aa44a38", "sighting_of_ref": "indicator--53b31fc3-1db3-4ea0-a203-a7189e4f0d9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7c87ae5-8d30-419a-840c-fcc8dfc04117", "sighting_of_ref": "indicator--12fa7ed7-87fa-474d-880a-2645a42be3d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac838c9b-f721-4882-b2f6-8f1fd8547767", "sighting_of_ref": "indicator--eed248f3-34d3-4677-811e-328f0a04ad5d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d31b3368-a2e5-42ae-8d70-80a2e26e1bcb", "sighting_of_ref": "indicator--25c19f20-a2c7-4750-b480-9017a737741e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7055d51b-e339-4f4d-bdd9-9aa5852f9a7b", "sighting_of_ref": "indicator--90870c99-d9c5-44fe-8513-6f920167919a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47092b7d-c4af-4e0a-a0f0-755234c24df1", "sighting_of_ref": "indicator--482f4ca1-916b-45ef-b73b-7e07fc23e821", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c6cf83-e02e-48a8-a0b4-bff2e76a0024", "sighting_of_ref": "indicator--ce998b31-3975-4358-90f6-0c899155487a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10646276-9344-4916-990b-dbde7d8f705e", "sighting_of_ref": "indicator--20645768-91c0-4053-ba42-56459d8c22ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89990fb2-13bc-4ad6-bf1c-44c0f7fca3e4", "sighting_of_ref": "indicator--ec5a3368-2f2d-4071-8f69-49f73d1b9061", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8f208f2-f598-4ef8-9407-07706dd729ef", "sighting_of_ref": "indicator--c7c1db9c-51b2-4f9a-86e3-9e94cbcb62b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28942f3a-f05c-4ed1-b8f4-fee3d0d5e1be", "sighting_of_ref": "indicator--73213ce7-1df0-4ded-836e-093d4b486691", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f7a3af-8f2d-4f97-9110-6ff19eb13b4d", "sighting_of_ref": "indicator--59279241-0bda-41f1-9d8a-2b3f351f69e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7f3a2e7-1159-46d4-bdd1-1ebfbb176f8c", "sighting_of_ref": "indicator--03715777-1702-4fb3-9368-e9473ab690d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44b4bfef-be4d-435c-b474-5d4245a0b102", "sighting_of_ref": "indicator--edf29abe-5e91-43e2-b155-ad0983a96486", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db48efc8-78d9-4f2b-b64f-aaf9dee46172", "sighting_of_ref": "indicator--03b8a73e-441c-4298-a463-7207ea7e16d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3afe4685-1ef7-4f51-915c-091ae219ab72", "sighting_of_ref": "indicator--4b0e714e-740c-496c-8bac-c1f851dcd39f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f61597b7-10e4-464d-865d-5d9042a4321c", "sighting_of_ref": "indicator--d6ea6737-a9f7-43da-9646-773c415b3e13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19e23eb-ee2c-433f-8c38-628fbd5a0383", "sighting_of_ref": "indicator--579723d9-e3e3-4136-8360-eccef5867fdf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da54a823-54bc-49fa-ab76-55eddf5cd6dc", "sighting_of_ref": "indicator--ef5fc880-4775-4e3b-8870-225e1fb5995f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c8b4901-c37a-4985-8ecf-61666a92f042", "sighting_of_ref": "indicator--d1b68a63-af9c-4c40-8b91-cbf2abb56802", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80c4892b-25ae-44e6-8316-e112ef88ed74", "sighting_of_ref": "indicator--9b457fd1-3b79-4f16-a69f-3bae4a0be4d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bbd073a-ff56-4d9d-9103-411db7b2362e", "sighting_of_ref": "indicator--96d04828-c2ac-4f42-8455-d6d1d8f0c2e0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--794f20d4-779b-48a9-8071-5823a2a330ff", "sighting_of_ref": "indicator--15dc010e-07c3-47c7-a83c-590ddff20a70", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c3eaa70-b04f-45d7-b6e9-b1b2c859893e", "sighting_of_ref": "indicator--62a2fe1e-3709-4719-956e-f59c9cf5f932", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68a6a689-6066-4bbb-befc-791ae9a027de", "sighting_of_ref": "indicator--c9e95617-8bf9-4dca-923e-6b9131d4d166", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0808608-ceb6-4d1d-802f-51ac57e149e4", "sighting_of_ref": "indicator--5dfc0271-cf86-4ac7-a496-b9402d68db5e", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32bb4d6a-ebf8-4b97-8869-b466482d4278", "sighting_of_ref": "indicator--0daad5d5-a41d-4367-8ce6-bd385e72b0df", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50f74aa9-a62f-46b4-a169-b28477ef7c13", "sighting_of_ref": "indicator--8b4799e5-0b3c-45d6-bb59-01c52fcc40ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c85e593-9cf1-4fcb-90fa-9d95c2252b73", "sighting_of_ref": "indicator--8b4799e5-0b3c-45d6-bb59-01c52fcc40ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4254de36-c252-4585-9333-0a0a6be4cdcb", "sighting_of_ref": "indicator--a9df15da-ca39-4780-9d1c-9043f2607876", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe2c831-7056-4ad6-aed0-07333d913938", "sighting_of_ref": "indicator--546c4b20-d493-49f6-889f-e1b74ec966c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4960f681-40ea-4e37-ae04-e127f43f16cd", "sighting_of_ref": "indicator--915001b6-2a04-4b7e-9862-93ac7b3d90a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f054cf-6872-4186-a1d9-6887d9aebd2a", "sighting_of_ref": "indicator--68eaf841-5a91-4ef2-8ac0-b0331e692cc6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b0132b3-0b64-4afd-a7ff-70c80bfdf947", "sighting_of_ref": "indicator--f94f8980-2bcf-4787-9610-c4b05e57fd3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc07365-a100-4a57-9e05-e8dc01d763b6", "sighting_of_ref": "indicator--641e410b-89d3-4aeb-9ee5-c5543abbc692", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f1437ff-4786-4f80-afe1-a73961133c9f", "sighting_of_ref": "indicator--024dc756-f14f-4846-9e1a-7e7a88f11a1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db5eaf70-cff3-4819-bde3-31e592768323", "sighting_of_ref": "indicator--aebce6e3-0bb7-4027-ba9f-94baf269ff38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01d0420-fc76-4e52-b67a-3783c9c65d47", "sighting_of_ref": "indicator--72f59719-af7f-4609-8a0e-d557f60fc842", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2168007f-8761-4077-89a7-6cf1c976ac7a", "sighting_of_ref": "indicator--a7741d04-6fbf-4c3b-a962-76714291f3d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb7a3cca-bbda-4c76-8ab1-0f12698cb8a8", "sighting_of_ref": "indicator--7b16b637-9c7b-4244-aecc-9605e23f9cea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a23490a8-7a42-462e-82d8-565fd123c48a", "sighting_of_ref": "indicator--2942cbe4-e6e9-439a-956a-7218c2a5cb5a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed8457ab-b195-448d-a9b1-6956e08b0472", "sighting_of_ref": "indicator--5611ac52-47a3-4a1b-a095-f8ea4f74ac60", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3be933e0-09c0-4003-9cf3-9dfbe435f44a", "sighting_of_ref": "indicator--aff1eea6-ba09-4329-99fb-7193ac6113b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5cf3db-81dd-471d-a1bc-8494b8fdb734", "sighting_of_ref": "indicator--29ebce87-6492-44e7-8621-78ad8be55090", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f4951e5-513a-42b6-8dd1-37d215b99985", "sighting_of_ref": "indicator--42cde192-da06-452d-9c3a-7f38a9e68389", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0c4d78-c814-4683-bbd3-b4930ffa98fe", "sighting_of_ref": "indicator--69fb43bf-288a-41e1-a82c-5601d7fa694c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04dd9dc3-6864-47b6-abaf-7880b2ad9c40", "sighting_of_ref": "indicator--ee4a9f8a-8564-40b8-a09c-960b2ce4763c", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08b1665f-46ad-4835-99e1-c3efcd8efecc", "sighting_of_ref": "indicator--fa04aa67-b425-4409-9e5f-7e3134a49e24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dae94905-0144-41fb-902d-ceea0accff4f", "sighting_of_ref": "indicator--734e86e9-9725-49c5-9125-8d3ff3178d97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf89bbe5-3e10-4b72-ab4f-2584cf3597a3", "sighting_of_ref": "indicator--fe9e0f82-a7d1-44e4-97a4-64dd173a061a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a1a04d-5dbe-46aa-83ba-321dbadf98ee", "sighting_of_ref": "indicator--fc7f9e89-1a2e-498e-a7b6-6d3af83b2e9d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e53cd75-450c-4bc9-b299-bb473bd8ea82", "sighting_of_ref": "indicator--7ed85164-e374-49a6-b7ea-db0e7d993d32", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a0b70c9-94b1-40e0-b02a-8edd330a5ec9", "sighting_of_ref": "indicator--488cae05-d057-4fe9-8efd-85b394517d89", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c89d5af-d7d3-42c8-acd9-a128036e03b9", "sighting_of_ref": "indicator--44d9555e-d192-4996-a2f6-dbe46d03a43a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57c28988-1b27-4889-ad60-932dc3712070", "sighting_of_ref": "indicator--9af0a759-0da8-48a8-8dc6-2dfc15309b86", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbe39bbc-ddc0-443e-ad65-83806cadbfb1", "sighting_of_ref": "indicator--74a408c0-21a9-4e06-994f-db69a44b19a3", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6891d47-68c4-4f38-b1f3-534dbcbc1b06", "sighting_of_ref": "indicator--e975826a-8a92-4f45-9e5f-06cf1868f5d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--202a451b-c680-4908-8bf5-389734681310", "sighting_of_ref": "indicator--00a8575a-c696-49ea-9c2a-9faaea101060", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c049ad3-9e73-48b6-8d72-c3802f6a8765", "sighting_of_ref": "indicator--f50b96ee-1058-42e8-9f17-19ea2b34ef2e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d97af34-1045-448c-997a-a45c121e5056", "sighting_of_ref": "indicator--d765e03f-2f38-4939-b1b5-1e60c558f024", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c42cd5cc-f9ab-41c1-beb8-ab66ad7e7169", "sighting_of_ref": "indicator--45ff0f49-daf5-46c8-b67c-378044dc8895", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f9f8f0-19f3-439d-9bce-818dc8829b9e", "sighting_of_ref": "indicator--9a223273-7291-4184-8bd9-120c1f0c7f9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c984ba32-7364-4d5d-aca7-42e04e3bbdd5", "sighting_of_ref": "indicator--95a09071-4002-49f8-9eec-080c529486f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb33b8d-4838-4ff7-83c1-3fbdf90d8578", "sighting_of_ref": "indicator--39796470-64c0-4aad-8720-1b0c4189ee19", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d4491af-0f43-4d3c-8fc5-72946ea4eeb9", "sighting_of_ref": "indicator--f8518c2c-a656-40f8-bc98-fbed32f10e04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45691de3-389e-4e86-a712-b515e498ea08", "sighting_of_ref": "indicator--f95b2db1-4531-496b-a1d2-72ac94ba9f09", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b60193-6842-424a-8e24-2834089a1e5f", "sighting_of_ref": "indicator--8324f0a8-604a-47a7-9707-7962efe22d9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa2ec24d-48d6-4c38-8b6d-fd9c8c3d7b66", "sighting_of_ref": "indicator--8324f0a8-604a-47a7-9707-7962efe22d9b", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--092e557d-496f-4942-a4de-33a860e467e9", "sighting_of_ref": "indicator--00f2bb12-1e28-4ce9-894e-15678bc3fdb4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f266d8-fdbb-4742-97ef-913ed6088add", "sighting_of_ref": "indicator--e7745584-703a-4e53-9330-433246261034", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c009133-3327-4cc2-9eba-5f8d45d795d8", "sighting_of_ref": "indicator--d3ada730-a2e0-4291-9eb0-19a96221b241", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19363c05-be77-4dfc-9850-276307ca2687", "sighting_of_ref": "indicator--db589e61-e3ab-40f4-a5cd-b7ab2e0a1bbb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f77b48-a7f9-46e1-a37f-08f7296acd6d", "sighting_of_ref": "indicator--719e762e-f991-4375-a480-a3d9e57c1ee3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1010259-ed77-422f-bd48-dc3bd12d9640", "sighting_of_ref": "indicator--637aaf99-3dda-4e6d-b8c5-0de024069441", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d184652-513b-4a66-ac38-522ddbb44ddf", "sighting_of_ref": "indicator--be89a87f-c2d6-48cd-a5e9-8d59b478cdd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b460bb9-50da-4068-941c-8eac5cf28904", "sighting_of_ref": "indicator--157083ef-4754-427d-86c8-b1d4e7e98da4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6159413-575c-4032-a9af-aa38300b250a", "sighting_of_ref": "indicator--d5c48c9e-ee8f-4966-9953-d3ac3a68fef9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1778f232-3223-4681-8fd1-111416e820d4", "sighting_of_ref": "indicator--2e4ff509-5292-469a-ab01-63a0712c21f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e4db22-d5d7-4271-a93e-baafa98a3bfd", "sighting_of_ref": "indicator--50a02043-2c45-4c5d-80b0-473da06e7d9a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f0557e7-e4d7-4f6e-bdf8-b53bea1fd0ed", "sighting_of_ref": "indicator--5ddbe416-8b63-4369-9810-ae77f6b96433", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b824911b-5e8f-4746-b356-a7b55e41f289", "sighting_of_ref": "indicator--6ab6964c-d640-480f-90f9-295b4f1af9e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--319e71a5-c52d-48b5-8128-33f3797f5515", "sighting_of_ref": "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c93a24-fd92-4eba-950e-4ab98fb54b02", "sighting_of_ref": "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f762b72-8574-4c74-af1a-178169cfdf1d", "sighting_of_ref": "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91bac64b-302f-446d-b002-8e5109f7724a", "sighting_of_ref": "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7dc68c0-e051-4c6a-a343-b1784e954039", "sighting_of_ref": "indicator--883b52c7-b271-45a0-92ac-42661e98d1eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eda7878d-0042-42ad-aaff-8ea946e51259", "sighting_of_ref": "indicator--6fadc886-1583-4827-931d-94439bf3136c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09e98a4a-75a1-4e29-a762-4d69d0e0b39b", "sighting_of_ref": "indicator--6fadc886-1583-4827-931d-94439bf3136c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32f0845-8b50-4e34-9c96-1ec6ab2f0f8e", "sighting_of_ref": "indicator--2cd4a41f-0503-41d2-85a2-2e9986707fbf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49bb2aca-dbf2-4bc0-888b-a623f4ccc9c1", "sighting_of_ref": "indicator--58399a1d-3bd6-478f-82a0-2a1467febabf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e779252b-1337-46b4-8eb1-b463d17c1645", "sighting_of_ref": "indicator--098bd1ab-148a-478f-9965-ee660b9380ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c582775f-cb8a-40e1-9253-f60b3b8eea7f", "sighting_of_ref": "indicator--098bd1ab-148a-478f-9965-ee660b9380ca", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b0a0ac-3419-4b59-bad5-0360b4a3e81a", "sighting_of_ref": "indicator--6133a4bf-23c8-482a-aacc-d0c24cd30608", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28cbb7b6-0a68-49f8-8ebf-df71fcc9a788", "sighting_of_ref": "indicator--6133a4bf-23c8-482a-aacc-d0c24cd30608", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33394e7c-35bf-4705-a8f5-5821dc95eb40", "sighting_of_ref": "indicator--93e57bbb-3308-4274-8aea-5f2b7d37784a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82c9e177-dd4c-4257-8af2-5731fdaaf620", "sighting_of_ref": "indicator--98f279cd-8c77-47af-992f-b41e4acbd6b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5ffdac9-f0bc-46fe-a68a-fe623cf6dd3c", "sighting_of_ref": "indicator--a65fafe5-5cb7-49c8-8cb9-ceca136859f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80cc62dc-97c6-498b-9413-9b06adf0df74", "sighting_of_ref": "indicator--8eecbd94-1490-480f-8e55-f27fd91cc73b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0d6e6a0-c741-4f02-a9c5-91a6bbe0faf7", "sighting_of_ref": "indicator--fbe6ef5d-0365-4904-a155-f7aba7a4461a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82ebcb2a-ba17-4be5-9870-c266cc9e0318", "sighting_of_ref": "indicator--0b03db77-5eba-43e8-a0ff-f2ced6217fca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94b0b9d8-df6b-4215-bf92-2ceb856712ac", "sighting_of_ref": "indicator--f4704259-70f5-4ce1-9511-b031d92f72a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a876cc53-5982-4b7f-8f8d-1977668b2d38", "sighting_of_ref": "indicator--a8432cda-11bf-4c27-90e4-e81c89b8c7a7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54dd0b87-94fd-4eb5-81fa-71c29c1aaab4", "sighting_of_ref": "indicator--e318641f-9d6f-4f78-ac55-a3a637be8966", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bfaa24b-4113-475e-a517-02b5aafcef06", "sighting_of_ref": "indicator--b4698ead-3cc3-4772-b84b-68d8f14345e0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29c0022c-204c-4aca-b03f-17935cd6eaa9", "sighting_of_ref": "indicator--74df525e-0041-4992-be8d-49ac8b918044", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de0a0d1a-058d-4653-ba55-c127ee0161c7", "sighting_of_ref": "indicator--af211e90-316d-4ea9-9a1e-ed83c1439440", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--710def68-e6d8-4f03-8159-896dcad5d6d5", "sighting_of_ref": "indicator--866b0c43-1d66-4385-9883-abd806252d34", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d1253a7-8f99-4ef0-852d-ffeb16556ed7", "sighting_of_ref": "indicator--a5c9c46e-e7f7-4775-8ee3-66a70218904d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b1b7ca5-32f4-482d-b79f-7f751ae3eebb", "sighting_of_ref": "indicator--189b2e81-57e3-453d-a989-46f6f2cec31c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61b130d5-2baf-41b4-81bc-7aac4ad3ebe7", "sighting_of_ref": "indicator--c9ef7015-505d-47c6-a8dc-3cbdec2667d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb9df15f-a70b-4fea-add5-770b9f479fd0", "sighting_of_ref": "indicator--96e162df-3ffb-4ce3-9690-24ca6d5b9907", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b18f44b8-e120-4a02-9da2-9b1f42830f58", "sighting_of_ref": "indicator--3c4e9fb6-fffe-4901-8f57-c890ca46e5d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d4a0723-cc6b-4935-b60d-a36ec8d032aa", "sighting_of_ref": "indicator--975f1c10-7b6b-4994-b3a5-f38a07ab1ca4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e439bbe-0477-46ba-af82-aad8fbfe8db4", "sighting_of_ref": "indicator--881d74fe-f5cd-42fb-b43a-897bb3bcf742", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--307b8cbb-5da7-4a09-96fd-9971fabba40d", "sighting_of_ref": "indicator--320950ca-171d-4cd0-9cb7-d95d4c598b55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba96290-190e-41eb-81f0-ee9d90acaa1e", "sighting_of_ref": "indicator--f42c22c7-55a5-4447-8445-1a13c78796b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee7d9cb-67ea-4d64-9dbc-849b0b39cfe1", "sighting_of_ref": "indicator--ebf11472-2659-44ba-91f6-7afeb371a1bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cde562b8-abf7-4012-a67b-1f2b4166ceb6", "sighting_of_ref": "indicator--00355a12-185a-4761-bcdf-95d482012300", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe29ebc8-ed38-447c-b8c4-29f8239657cd", "sighting_of_ref": "indicator--1b56132e-2509-4fa5-a652-ea8912ca0970", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27f275c1-bf26-471d-8d1f-97bc34c35f16", "sighting_of_ref": "indicator--7ca357f5-9589-4aaf-9382-3bf953500d59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293d602f-93f2-4d4e-b188-85831bf2c48d", "sighting_of_ref": "indicator--49710638-9af7-4bc2-b1af-5fe7c3356fbb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c5a16a8-e816-40a5-a4eb-968347ca974e", "sighting_of_ref": "indicator--725c6de1-fce2-4314-8c14-803c23e6f620", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f48e00df-35e1-460e-9d3b-ea54202f1cbf", "sighting_of_ref": "indicator--620be3b8-5a1c-4fc0-9adb-d0c9a2e2c63a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--997215b7-107f-48c3-9d1d-496827869ee5", "sighting_of_ref": "indicator--85b0ee23-d4e2-49e0-89ba-9a9eb1d82791", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--894814c0-e69c-4074-ad79-4fe5b39de6ac", "sighting_of_ref": "indicator--5dbc5de0-49de-4952-aeb0-fe205efa7f90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06c26b3d-589f-4da7-abae-1dc890269c6f", "sighting_of_ref": "indicator--1dfa3594-6de5-43b4-a278-28eef0928b73", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35123cc3-7b59-46ee-b82a-0b5feb3ccaff", "sighting_of_ref": "indicator--eb677430-adc8-4fc1-87e4-20d047302de9", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f8c1d9-0a84-4801-863d-bdb2d095bc2c", "sighting_of_ref": "indicator--2776d06a-0989-44e6-9cb2-b596e32d143d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf6e20b9-93a5-42b5-8bbe-8cdf00732116", "sighting_of_ref": "indicator--6beca09a-4e48-48fa-9850-0fa2d62b79b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4865af2-ab7f-405a-b56c-6d9092e2a378", "sighting_of_ref": "indicator--b0481859-4666-4adf-aa0e-743014a760da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60f6e1c4-0994-44d7-b4cb-4c79d7a3abd0", "sighting_of_ref": "indicator--3b794b39-099e-4760-a409-aacb90bb173f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccaef2ca-8c2d-4a06-8c67-0657ff7cd58b", "sighting_of_ref": "indicator--460ce4ba-4ab2-4f7c-8d98-5258d91ac781", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43860b0c-b8dd-4501-843f-48b17d890020", "sighting_of_ref": "indicator--38cff06a-5eae-4130-b3a9-cee4749b5010", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--245babdd-cd60-4868-915e-07597de88e75", "sighting_of_ref": "indicator--15ce5723-500e-485a-a509-f81af7a7196c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e28ed04-33c4-49c7-8137-c2d88064d147", "sighting_of_ref": "indicator--ee4e25e0-c272-4383-b6bb-aa7da623f467", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--848f007b-7ef6-44c0-bf1c-b4de4138ebe6", "sighting_of_ref": "indicator--8616158a-38f2-4364-8b5d-30dae6031315", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f11bd7e2-3fdf-42d5-afd3-df986123162d", "sighting_of_ref": "indicator--0b0f2682-919e-4d4c-8d59-fbdfb6f00d66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755a5ae8-8ff7-4d53-8026-cb82cf20419d", "sighting_of_ref": "indicator--721c9081-f3b9-4435-a592-c298ac21f11d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bffc9c55-6421-4b1e-bf15-06a44ac7c7af", "sighting_of_ref": "indicator--ec35fcad-ecf1-4aa6-9a3d-dfd5f76e87cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84bc6163-f7ce-494d-be1a-3cba7be5b284", "sighting_of_ref": "indicator--eba47daa-5c3b-48b7-a95e-3630f0357266", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189e5e5f-71c8-4a90-8f6c-e5e642481044", "sighting_of_ref": "indicator--a01d82ff-0025-45b7-9702-58a2723eced8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404b7f40-9951-4923-8dca-a7bc1bb01e88", "sighting_of_ref": "indicator--8a22825e-14f3-44d5-9618-c16544c4f98a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c3cb3ad-2270-4455-bf60-225e6863c642", "sighting_of_ref": "indicator--d7b9c47f-a2d7-4012-8d8f-ec253f9dcfa9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40dff059-9e9b-47fe-8e35-795a0f8655f0", "sighting_of_ref": "indicator--a712eba6-8904-4ff3-b039-ed49e79f93ea", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45bc3a24-6ab6-42fa-9f35-bd0e460574de", "sighting_of_ref": "indicator--b909bf54-fb07-4bcb-a3ad-677c6b56f38d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b01555e-329e-485c-8896-73b884c5ecbd", "sighting_of_ref": "indicator--42c534b0-9d75-4991-a95e-9054d02de3ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d40bc7ab-f3e9-47fc-87b1-e99c692e7339", "sighting_of_ref": "indicator--47c74c18-70a5-4ea6-a13a-f9fba6bee157", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56a82ec0-88dd-48fa-be09-d2b0bfc22fe3", "sighting_of_ref": "indicator--0d765397-6f5d-4677-8565-da1f08fd00cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158f285b-4716-463a-b3aa-3453c203edb5", "sighting_of_ref": "indicator--fc76d65c-85ab-45c9-aa78-178dfd703d26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab3f482-8947-4eb3-ad43-6031b923bf3b", "sighting_of_ref": "indicator--7d11a715-1192-4d4e-bd9e-89d5c7495de1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--488e9e84-1718-4564-b190-632e96ca24b3", "sighting_of_ref": "indicator--c125aeef-48b2-40d5-8faf-ec7188506967", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8ec47b0-d375-4047-8b62-c964e9e8a56e", "sighting_of_ref": "indicator--dbde4d6f-f7f7-45f8-8203-65d8999cd86a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34dd85e1-bfc6-458b-a700-9cdd0535ffa2", "sighting_of_ref": "indicator--e943f889-a8e7-4993-abbb-43de6da2ee21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2456a33-b608-4067-8086-92cbcd3a2af7", "sighting_of_ref": "indicator--ee860032-52e0-42e4-ba33-fc4f390b387a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a97b9532-123d-40d4-a66c-2e70347f70a5", "sighting_of_ref": "indicator--ce1cc755-a30a-48a9-91d9-1042e42f6582", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9732e2-fe5f-4e7b-a302-d0394eb3defe", "sighting_of_ref": "indicator--7cb11f51-1318-4dd1-be63-dfe59c0e295e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc829376-bf0e-49fb-a3db-0c1245b893bc", "sighting_of_ref": "indicator--8f10ee98-3aec-476a-841f-d12014bafa68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c33c8d3e-96b2-44a2-8a60-8a9782be7772", "sighting_of_ref": "indicator--b864d379-50a7-4de0-96ea-95b0326cd1d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8773825c-c75c-4302-a13d-cf3600c67b91", "sighting_of_ref": "indicator--defe4280-783e-49f8-8e7f-f9cf5e4c13fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18bfc4e-6efd-47e7-a833-4db0dac10190", "sighting_of_ref": "indicator--67c58f33-009d-423e-a627-16891dd03f39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1430466e-9c51-42ff-8e0b-4e0c1d191ea5", "sighting_of_ref": "indicator--5a57114a-bd5a-48b6-9342-1908d937fcd9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bbd8fb1-d36c-4838-a0db-d63c4f16c191", "sighting_of_ref": "indicator--fd86a198-0d39-42d9-bddb-9239a7cc6879", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56c6fdd5-1387-4ea2-8408-847a46d39941", "sighting_of_ref": "indicator--7471464e-cdfd-47c9-9a92-6be5852ebf3f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--481749fd-27d5-426a-bf14-d1585c486ee9", "sighting_of_ref": "indicator--ddd49f32-87ae-40c7-95d4-7742e0e66650", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08723590-51e0-4b72-a3fb-0b260d5a83e3", "sighting_of_ref": "indicator--d8a98d4a-400b-4b08-b382-ac68afde207b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18945f7b-9529-4853-b5dd-eb7ab5f8ae70", "sighting_of_ref": "indicator--d45b0e19-e7d6-4932-a8b7-85ff71e9b164", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0197008c-c23f-4b3a-a4c0-d60bc38e2d2d", "sighting_of_ref": "indicator--70fd2d6d-e3e1-4078-927e-dae8ee48f9bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdc20e86-ff2f-480c-aefa-24c3bbd9b76d", "sighting_of_ref": "indicator--a7a267e8-67f4-4e18-bcf4-96f268706b64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d4d6e09-25d2-4964-a3fe-b225389d0c66", "sighting_of_ref": "indicator--7c6e2ae6-f56e-4482-9d49-2c436721648c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bddcaf97-f5be-434f-befe-192958a6e8ff", "sighting_of_ref": "indicator--8d3e1c9a-e89b-48c9-8260-57ce73179d5b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5e80f58-7280-466e-978b-a41afe661d26", "sighting_of_ref": "indicator--21a5aa93-b62f-459f-9d29-eb6628695c6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a642c7b-d5b2-4b4e-8562-5f8b99e09846", "sighting_of_ref": "indicator--efe03bac-ce67-4faf-8ab2-7a0e49f76b69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3794e71d-1739-4959-8f1a-3f94cbbdb641", "sighting_of_ref": "indicator--71ad433f-227a-4b3e-9cdc-79387239ee8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--217f8a2c-cb28-43a7-a6b1-e0c6fca6a879", "sighting_of_ref": "indicator--5fdce8c5-b21f-4a22-afee-c3b41241e5d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c99156-e2ca-48b9-8494-98874291f578", "sighting_of_ref": "indicator--70d22c84-a848-410d-8f8d-47e4a5ffaa36", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e661a7d-d19c-4785-b146-97c7bc471e4d", "sighting_of_ref": "indicator--ea4202de-fb12-4f4c-95b4-7ab6157f96f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d80373a0-f351-452e-82a4-3e06c3eb1526", "sighting_of_ref": "indicator--52368033-6bfb-4a5f-94c3-732f2a4c7b4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5388d1ae-ff80-42de-b3f0-340cc446cb61", "sighting_of_ref": "indicator--b301fcf2-0098-4301-b5ab-12be40e84036", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--646f2408-a068-458e-914e-5e36fad87424", "sighting_of_ref": "indicator--fc2f0e6a-e825-4f49-a9ac-adfea26fb6eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2152e523-fc2d-4f7f-9684-cbe8180973b7", "sighting_of_ref": "indicator--dd4e08f3-e3ae-4ce9-91b2-e7ed43343a43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d67c7bf6-7167-44ae-9851-edbd5309bffc", "sighting_of_ref": "indicator--e92ef3ac-3e5c-4988-a6dc-a3ad09a9b991", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2294dbde-6def-4655-9570-43358835502c", "sighting_of_ref": "indicator--875a32d6-a897-48be-b8dd-b2a7779924f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3948d55a-1fd1-4533-84ae-9d3247e08aca", "sighting_of_ref": "indicator--70c8a5d1-f77a-489c-a556-62c7c19c3f3e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d2e62e-46d4-4460-be6e-be65f231c968", "sighting_of_ref": "indicator--1d20e84d-e1cd-4c1e-831d-3dfe46abb478", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4034319e-f180-44a2-bcdb-c685df8a68e6", "sighting_of_ref": "indicator--f64dcf44-3c27-4f64-84cb-0cbd06b818c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c19a0c0-dad5-4dd6-939d-acebea512cbf", "sighting_of_ref": "indicator--1ad01185-c76b-4f62-8210-dabef50d6275", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ddbe85-27e3-4357-8c47-41ae83a040f2", "sighting_of_ref": "indicator--32276fc1-e8da-437b-8f78-635bf90b0e63", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5089c0e1-1668-4a2e-8ddf-4cfa101b7bb7", "sighting_of_ref": "indicator--c5654acb-3779-4099-8efe-4fa1494591be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b272989c-ec6a-44ce-a3ec-a812645461d3", "sighting_of_ref": "indicator--5e1af656-e405-44de-8543-fc72a11cf511", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa837bef-0f61-4450-9b1a-ff2dbbd6bc4b", "sighting_of_ref": "indicator--f833f224-618e-4f24-a071-1dce9ecd8fe8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9a7413-87ac-4a44-9127-f4d86b64f628", "sighting_of_ref": "indicator--27701207-6eda-4fda-baf3-52856d6dea4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9c794c-a470-4c22-a5fd-5474d20a0f07", "sighting_of_ref": "indicator--2fb8ecd1-9a2f-425b-8e2e-48624c31a4a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8030ff44-3d09-4698-b13a-3e27cff37169", "sighting_of_ref": "indicator--74d7dcf6-2369-47b3-a61c-fdfd13b55f96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc2db78e-3f5d-421c-9e57-597deb926910", "sighting_of_ref": "indicator--60b2f242-3a19-4067-9756-66b0be4e450a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0763f14-b09f-4c50-b528-c5a165cdfdad", "sighting_of_ref": "indicator--e5b22268-5b7c-422a-b0d4-08e1157f15d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61edf531-6ca0-4013-b1a2-d4232efc4452", "sighting_of_ref": "indicator--6dbc4717-c741-42fa-b700-ee22566a7f77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fed99b-a98c-4516-954d-01170e620d6f", "sighting_of_ref": "indicator--3e519cec-d233-497d-a42f-390913a3fa77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--244600da-e0df-4102-b7dc-a3c3acb912b1", "sighting_of_ref": "indicator--b7934a52-f102-4a5b-80fb-ad26dcb321f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e70f201-4392-4185-8822-dca279ad57d6", "sighting_of_ref": "indicator--1b5af80e-2f95-424b-a90a-a7844f2f7b07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befe3489-9750-4609-9636-805811e199b6", "sighting_of_ref": "indicator--bc5b22c7-a945-4d5e-81af-1e013aa49145", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a52f6a1-2281-40be-bf27-158a82572eae", "sighting_of_ref": "indicator--b216bdb7-182f-4bbc-8351-51cdf524c830", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e579c99-307e-4dba-be72-0cd60fddab3f", "sighting_of_ref": "indicator--1c36a859-10cc-4dcb-b30a-dd65349596f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--393046ef-0244-40ae-8b06-0375f052a2f1", "sighting_of_ref": "indicator--b85b2180-1dbb-4858-898f-c314ff7e40dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09813cc6-a25b-4022-bebb-59388c5dc1ff", "sighting_of_ref": "indicator--d868f186-ddcc-412a-ba1f-06556e8c5cfa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6161139b-4023-4af6-afec-2aeec3eccb66", "sighting_of_ref": "indicator--d7dd9597-d297-4ace-9d97-c9002b16bd4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03779d11-b88d-4129-8d7d-224f7f663c27", "sighting_of_ref": "indicator--50f9072d-68f3-4f6d-87dd-2b7aa328355e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6dd1c9d-07e8-4ea9-a6ff-284e995c7c82", "sighting_of_ref": "indicator--bdbbaca0-5ae2-442d-8e8f-ce46ff0a7e42", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bad967ce-130f-4b09-989d-8fc0258c4529", "sighting_of_ref": "indicator--acfffd73-a0ae-4c9b-8f66-c710c012de54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281f3019-871e-463d-a43b-c83a3954b5e8", "sighting_of_ref": "indicator--edd62474-0ae9-4659-8903-3711e7316abb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1829a00a-96d6-43d9-88ab-5f524de64df7", "sighting_of_ref": "indicator--dd29de53-2b44-4015-86b8-edd5629d6a49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08c47975-0c99-4f82-b3c4-72385204a4dc", "sighting_of_ref": "indicator--28cc8f46-5e9e-445b-9d90-de76a2f47865", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82572247-4b52-4e91-b522-6e5d48dd7859", "sighting_of_ref": "indicator--3ada75c9-301e-4202-ab95-eca9ba768e04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c35afb22-ce24-457c-be9f-35d688b023c0", "sighting_of_ref": "indicator--f451e014-0a56-4b85-b04e-1eccd2eb2c6a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed03cf8d-6cb1-4a0b-b690-fe2c7f1f9fed", "sighting_of_ref": "indicator--c742c40b-b257-496e-b90e-421e8a4952b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7279c1-d088-4231-8e90-e32c046ceeeb", "sighting_of_ref": "indicator--4e66b029-d050-458b-a6d2-3e70f5d899d4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ae947b-6c5d-40aa-b23b-9b9fccbe2a50", "sighting_of_ref": "indicator--1b9b12da-30b4-48f4-a5be-93d45555fda6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9ae6983-9bdd-4401-a9f0-c868da4c223a", "sighting_of_ref": "indicator--295fcc5c-b65c-4643-a639-e5588afd613e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1064812-e2a0-49b6-8f86-655aef637845", "sighting_of_ref": "indicator--20a406c8-d640-4b48-9ff8-2e8039d54140", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb94a969-eabc-437b-9ee2-86e9fc30d688", "sighting_of_ref": "indicator--9b4bb346-6bfa-4927-aece-7f07cba41bd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--114aefab-3589-4a82-a43c-768de40ee05d", "sighting_of_ref": "indicator--f4567d02-9205-4c3c-8444-f47fc7785735", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2298edec-0290-4815-9b7c-01e72e059c7d", "sighting_of_ref": "indicator--b39f4da3-a951-4605-81a8-84ea81bd2d6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9df0e979-31d6-4f38-b259-079052c3c302", "sighting_of_ref": "indicator--87c142a2-b2eb-4be6-a457-ed79a5723f52", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc2f560-dcd8-4268-80d0-53798f9c7c18", "sighting_of_ref": "indicator--668c2ae8-52d1-4367-961d-16072d43d0c1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d5a1a87-766e-4c0d-8acb-611085148526", "sighting_of_ref": "indicator--a0ff5394-3290-4eac-9c6e-beb818c4b4a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3a4709-0acf-4241-9ab7-e2b7a11fc170", "sighting_of_ref": "indicator--cbae4354-a68a-427b-8245-7eee1b7faa7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--013908b7-ab96-457c-9e1d-1ab6615deb81", "sighting_of_ref": "indicator--80e1c7ee-52cb-46c9-af79-e6d03bcc4bc8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c2bf334-4141-4258-9d05-bcce2e47a628", "sighting_of_ref": "indicator--da0d97af-5696-41bc-b3e3-01494ed683cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--982c03b6-a9a7-4acc-b956-3f68d43ab7d6", "sighting_of_ref": "indicator--7d182735-f2e5-4999-81b0-fdf70098870e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e0e9e66-2f44-430b-86bd-239fef8b6c39", "sighting_of_ref": "indicator--df972c00-d76c-4d59-92d0-af94ae06570b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51ed6c49-2f74-44b6-bc1e-68e164ebd989", "sighting_of_ref": "indicator--e7492515-abfd-4f90-9b5d-69e462922217", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26744971-5b92-410f-b944-63c452478fc0", "sighting_of_ref": "indicator--21013657-4a65-41fd-9cd5-1172b663d238", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be7b5083-d4c9-4277-afb1-4e53c489d5d2", "sighting_of_ref": "indicator--e685c4bb-137c-489d-bdac-413c9562be77", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab92b16-2951-4fc9-87d2-0d145e5908aa", "sighting_of_ref": "indicator--f4ed624a-eecd-462f-b735-2ca9c8458ff2", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0aed7ff-701c-4a37-a3e2-c7005d0f57a9", "sighting_of_ref": "indicator--fb8f7a05-f881-45c3-a20d-177493e21ca7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f01e4a42-81b2-400d-bef1-f0a8642c36dd", "sighting_of_ref": "indicator--a909c2a3-455f-40bc-87ec-d99c6422b54b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6d0af7f-8ed0-402f-9f52-6a2bb01d2da3", "sighting_of_ref": "indicator--054acc7f-e38f-4eae-a78c-96a7e3336da7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03c33165-325b-4dc3-8854-03e6cbeb27ba", "sighting_of_ref": "indicator--240affa5-bc37-4dac-984d-0f233154b9f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19826b64-5f22-4b87-ba2d-40250e6a9ca0", "sighting_of_ref": "indicator--c76c7647-f849-4c98-9b5b-697e3ec4548f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--281161fb-919e-4cba-b21a-6c8f50697102", "sighting_of_ref": "indicator--be35f52f-b8d2-4bca-8dcd-6834e8edb49e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f8c0d2-9a0c-48e9-bfb0-07258560afa6", "sighting_of_ref": "indicator--f8f4270d-8cdd-46d8-b108-436228266f67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10958b5d-db6f-45bb-bba0-f1a2332b9cc2", "sighting_of_ref": "indicator--9ad66c4d-0a38-457e-8444-09a44b594fcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eae940a-4b3f-47b3-8787-dc67032aab09", "sighting_of_ref": "indicator--7e065350-a772-4a7e-9f84-dc34d4a7a548", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54e9a794-fed5-4bc2-a907-83eb8dc3f4c1", "sighting_of_ref": "indicator--7d56dc2e-6929-40c5-a1fd-7aa6d326551e", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cab0e8fc-3741-4bf2-b144-29c42c642734", "sighting_of_ref": "indicator--521835f5-0e6c-4bc5-8958-9a5e8efd3b2b", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2770ca7-0325-4ea9-8b61-1e3ada04a320", "sighting_of_ref": "indicator--448215ad-7de6-4569-b209-ccb1884aafef", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e793ab0-e1f7-4974-996f-c1d7da9474eb", "sighting_of_ref": "indicator--2495ea0c-4cf6-4d97-90e4-f480deb13a87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--803de490-8c1f-443a-a180-e7c3e69ebd6d", "sighting_of_ref": "indicator--37f749f8-6be2-4dd8-87ca-b1b4810a0857", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5993317-894f-46df-9fd1-1a5953696fbb", "sighting_of_ref": "indicator--22d4757d-90a0-486a-a9d8-8abd58753348", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35ee7a2-3cfd-4353-8d00-53588eed8842", "sighting_of_ref": "indicator--98e910d9-80b6-4540-ac4c-d3cbe573812e", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20272589-db26-452a-ae4d-b8ca56f7a9b8", "sighting_of_ref": "indicator--4b2e2c01-b209-4ba8-abd1-4881740331aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdb14374-3d98-42c2-99f5-34f3007dc461", "sighting_of_ref": "indicator--9eebb010-3fdd-4f18-b67d-3564e9755f01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a44dbd9d-7b99-45a1-83ec-4a32c158a881", "sighting_of_ref": "indicator--f91e9626-8cee-483a-9aae-82062ed79746", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b4766c-4494-431e-8239-180634cba09e", "sighting_of_ref": "indicator--e56b6135-0eff-4f5e-aa82-53ef511f8076", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc85b05f-61a8-4e17-86dd-c01df9842cf4", "sighting_of_ref": "indicator--d4997fd4-e132-40c8-aa3c-0fa8140195b7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--054b4320-43fd-4a83-9ddb-c566edfab0ef", "sighting_of_ref": "indicator--e735c178-51cb-479f-bb49-38d4fedf2e4f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--139f80f5-75f1-4b73-b4eb-8c1808893ebd", "sighting_of_ref": "indicator--d091e1e9-9f3b-4871-a3e8-db7ddf2ff01b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c62942f2-d3ba-41a9-a7f9-b851b2f0eed0", "sighting_of_ref": "indicator--e078b0b9-88b9-4655-ab1a-f4f5cfe34b6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7543332-d7cc-4197-ba02-56616ca9a2f2", "sighting_of_ref": "indicator--0fa51306-efcc-4b14-9ae8-b0e7d8779d73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f00e01-1caa-42cc-8466-432eaf9f016a", "sighting_of_ref": "indicator--9259a270-e8e7-419f-96c5-360e0994d461", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20923efd-dfd6-4865-98d6-7848c5bc0c70", "sighting_of_ref": "indicator--ae10c531-dce7-4f8f-833a-81df3d7f8975", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b29791e0-f031-4be5-8903-d2b6e0140562", "sighting_of_ref": "indicator--ff187cc9-eecd-4138-af7e-f01b48c2eab3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74b8ef3d-b207-433e-9e9d-7faa3f278cd6", "sighting_of_ref": "indicator--5b0a69a2-e1b4-4921-b030-236a33a53ce0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27bbdfde-2342-4cba-b0a1-6020fd48f069", "sighting_of_ref": "indicator--8b5e2cea-d94c-4a89-bd9b-5dfd6332a152", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05365f28-b39d-4b94-806b-7c36c3064dc0", "sighting_of_ref": "indicator--3b8b49b9-0359-4ee6-9ced-338f8e5da35d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30dc8882-66fb-49f9-ac50-08527227bc17", "sighting_of_ref": "indicator--9e14d260-fac2-4a21-a864-0a714887ea27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ac9b4e-5588-4cfa-ba36-5be10791ec9f", "sighting_of_ref": "indicator--ddafd289-871e-4ff8-8b02-47d0af3708fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d254242-766b-4c5f-a32e-f23dd1e37659", "sighting_of_ref": "indicator--ec4bb80e-7e86-483f-8130-5d111194cd01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef927f82-e96e-466e-af18-6f62efd9f82b", "sighting_of_ref": "indicator--869ba52b-4c29-4219-b2d2-4e26955ec9eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800fe63d-c446-4b0d-bd3f-c0f0d025434b", "sighting_of_ref": "indicator--0c58dba8-4e0a-4f8a-b1f9-a28d90b5b477", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c000acc-021d-4384-b866-0c7d991000dc", "sighting_of_ref": "indicator--0238b86f-f3ca-4d0b-8975-d803d7d017c0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--187f5d7a-626d-415f-a468-929f10a8f27a", "sighting_of_ref": "indicator--9b16da12-e7a4-4a7b-9abf-a0cbc69aed51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c32ec12-340e-4d02-b4f0-074308d8952f", "sighting_of_ref": "indicator--2b102374-06fe-4044-a470-59e6c7bcc2d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d19f46f-f296-4cc9-8fd3-c52f461e58a0", "sighting_of_ref": "indicator--4fb92d7c-295f-472e-9061-05a1b7201af6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4722bd0e-9ed7-40c3-a54c-01adea067ec0", "sighting_of_ref": "indicator--d9ca396a-ca28-43f1-886a-74c774cbdccd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f2e04ce-4f6e-4b30-9626-cc68d2a0c7ba", "sighting_of_ref": "indicator--078e0e72-2005-4b41-9445-014260bdb6a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--582dd933-ee88-44ec-a487-d783c8523679", "sighting_of_ref": "indicator--3294a8e1-ccd2-410e-9c7f-85cdb229b1d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edb809a9-d9e4-4818-af4a-d61a1e103328", "sighting_of_ref": "indicator--f81da208-af25-4c4c-bb43-c23d46cd1a6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--059eb888-12e5-40e3-8a2c-77142a2f37eb", "sighting_of_ref": "indicator--2411a42c-b807-49ec-a45d-ac82af9fe21e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2769c5e8-090f-4e82-809d-187934bac7f3", "sighting_of_ref": "indicator--b9cc414f-a23d-4cd3-af19-f74c0532cf82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0430fcf9-99c7-4937-9783-54eefa3fb6f5", "sighting_of_ref": "indicator--faa03199-89fb-4357-b56f-fa5a07ba3410", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e88b65b-83d2-43f7-998a-c3f690473502", "sighting_of_ref": "indicator--289276f9-e223-460e-a005-7939109a4ba5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--720edf4d-dfbc-40d9-9303-68efcb92e522", "sighting_of_ref": "indicator--0d95800d-c3fa-43c7-b94a-54a3cfbf0b1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc9ea2a-b348-45d5-b180-acfef08ff2db", "sighting_of_ref": "indicator--f9123af9-1da9-480a-9f96-4e9a5706c481", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d5b02c8-d1bd-4fe2-a99d-174366698308", "sighting_of_ref": "indicator--7adbea27-9d76-47af-af9c-cae75dee08c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c47b06c1-a464-4493-96ec-862cc5671de0", "sighting_of_ref": "indicator--69b01503-bf5a-4252-96cd-df870cacd658", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--015f2871-30ae-4a93-92cc-56d35ea602d2", "sighting_of_ref": "indicator--0f670658-3261-4c31-b7c3-c8fe7d901088", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163e52f1-39f6-4634-9236-33b4d33d82c3", "sighting_of_ref": "indicator--95116fe0-4cf3-4429-98e5-59d84f525a97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d08b15a1-2e58-414f-a21e-ae960eded912", "sighting_of_ref": "indicator--f65a3ad9-c083-4a91-a6de-1e58f504e45d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f2b0744-395b-42b3-84d5-0fb05da3cbd5", "sighting_of_ref": "indicator--c8283857-b5d9-418f-a525-a7cd4e5f8706", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c79bbfeb-0447-4bc7-9638-e51a3552b2dd", "sighting_of_ref": "indicator--bf124b74-f902-4ab9-85c1-d673e4452316", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6dcb8de9-4b2c-4c73-8a22-e70d51f60b0b", "sighting_of_ref": "indicator--7055bacf-cbfa-4a9c-9d79-a95b3a7bf5cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52b93973-22e5-4e80-9eed-3cf356d88f5c", "sighting_of_ref": "indicator--f4df1da0-7e00-43c2-9813-3393c821c111", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89f95caa-cb1c-4619-8f6c-d082837f1cc7", "sighting_of_ref": "indicator--5d76b5ff-c91b-4e5f-bb4a-e378b36e5e7c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--009f0ae1-93b3-4c9b-b3d2-526268bb3470", "sighting_of_ref": "indicator--25e586a8-e2f3-46eb-87dc-862ff0dc7956", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4571f4b0-841e-4a74-a181-f9415811dfa4", "sighting_of_ref": "indicator--0d20f842-c0d4-46db-9037-4153f8ba2eae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6d132e9-f5df-480a-9956-14f3addc4c0e", "sighting_of_ref": "indicator--54d5e18d-6e53-4231-8580-765ecd61b489", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c45afe9-12bc-4f6d-b5a3-702672c73c02", "sighting_of_ref": "indicator--241661df-bb5a-4b9f-881f-ead77ed4cbf5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2641f50-0b9d-4202-9f4d-83905c6f7625", "sighting_of_ref": "indicator--fae48e48-c033-40c0-a5bc-0d6257dc81fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59daea6e-a172-408b-9c8b-9bed00a99594", "sighting_of_ref": "indicator--28fb0579-d6b6-4092-8ed0-2839d61e85da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4402dca-b074-40f3-9a5b-ad83e00f4bcc", "sighting_of_ref": "indicator--039f219b-69d2-4886-a928-b1608666e334", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b508e36-2235-4361-b49e-09c66d33c16b", "sighting_of_ref": "indicator--2474cb60-4c52-4931-9d47-5b8b9965f3c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57cdfc57-b929-473b-b7e8-b35e1937c5fa", "sighting_of_ref": "indicator--27aa73e6-8b12-4c43-827c-354da17cc086", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--266701c1-b948-4c15-90f2-c7cd2d95b10f", "sighting_of_ref": "indicator--8c55f53b-d389-4698-91a5-7a008e6dc4da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cfdf434-3bb6-42b8-b9d6-242d74524b9e", "sighting_of_ref": "indicator--6d4668fd-3eea-4ed0-9593-32dfdf175a4d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--873ec894-b583-4dd5-9183-0b339d1d61d6", "sighting_of_ref": "indicator--9f79306d-ca7d-4fc4-88f0-35245d42efa2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9a752a9-efca-44c3-9a79-b0f54471ed45", "sighting_of_ref": "indicator--824c84be-7728-434b-8f60-f1befe7867ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41cedcfc-09e3-4623-ab42-781f53788395", "sighting_of_ref": "indicator--ed1a66b3-bf59-4968-879c-67455e9d373c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea7c9751-b5d0-407d-a76e-fcb1a897c7ad", "sighting_of_ref": "indicator--a62faf0b-2219-4743-9097-1da1cc8c91aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--789843ac-6e39-4ac8-8a1d-4abbe682ed29", "sighting_of_ref": "indicator--803847b7-b86f-4ec6-95d9-03b7fff45a85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7bb9a7d-a5b4-433c-96fc-e3443e04f9c8", "sighting_of_ref": "indicator--1789c4cc-d9fb-4516-b9db-b73dc7969830", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16a4b22e-a16b-4602-96fd-c241d697be30", "sighting_of_ref": "indicator--94985467-3409-4963-a923-7292fb9965fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a6d951-ce28-4501-b018-acf0fa1e16d6", "sighting_of_ref": "indicator--5ac5766c-48af-4bf6-aafb-6514ef0f1a37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8454567-b81f-4d1f-9f2a-b77391949a95", "sighting_of_ref": "indicator--bdf39286-655d-47dc-9f92-fdbbe11a050e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02b1ca54-6b0e-40f1-972c-d3b09a2a1c90", "sighting_of_ref": "indicator--f2586b1f-6009-4bb7-a067-9ebab1133c07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccf43f05-9995-4c27-8b09-55377760170b", "sighting_of_ref": "indicator--287e8656-f04b-4485-9674-cdbcc19e48b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e6ce5e4-3ebe-4c83-be16-d2bfae9770a2", "sighting_of_ref": "indicator--b0106187-f604-4042-885c-402d7428a4af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--534b4efd-d711-4de4-82ff-7e06bf2ccf58", "sighting_of_ref": "indicator--04d39ea6-ffc3-4fdb-a050-09e936c1a3ef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2923c3ce-fe1f-49be-a609-484e190c157f", "sighting_of_ref": "indicator--8273ea39-e717-4e1d-abae-97bdb13d5b6a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6813f3b8-f977-4b64-936e-a28c466274bb", "sighting_of_ref": "indicator--1d3633d4-68de-415f-8cd9-3d2750b00b59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f98c894f-1da4-4d3b-823b-5647b77aaf4f", "sighting_of_ref": "indicator--11423ab9-4f00-456e-bf0d-f186a1e900c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f63dfc8b-a49b-4759-8b89-3801a380b806", "sighting_of_ref": "indicator--9c808ebd-ae37-4173-8238-dc2e4c9808f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c237af5b-c6b6-4483-b877-2ca164edd25f", "sighting_of_ref": "indicator--dbf032dd-5289-460b-b2f7-0014a5157155", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8cd1c96-ca32-4c8f-8745-07e9737c24a3", "sighting_of_ref": "indicator--2833ab03-4607-4bbf-af3f-a2ee77ca3b94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f55fbc9-fd2a-41c2-84b1-d509d6db41d7", "sighting_of_ref": "indicator--1c61b77f-7cd4-4938-9431-e0f67acfa882", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c63c7dcb-5220-4302-9e8e-4e7c8f3302f1", "sighting_of_ref": "indicator--871a3531-dd9a-4362-b943-083a164787fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3675a531-1b32-4ccf-80a5-fbd450781682", "sighting_of_ref": "indicator--6398ca83-c129-47ab-ac33-ac0cc3fedd5e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a31e0068-2a90-4e45-a280-796ba3929a52", "sighting_of_ref": "indicator--9426c4c0-fc14-4b17-822c-1353284ce9a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05b17ae6-4c1d-4f50-909a-ab0450aeed43", "sighting_of_ref": "indicator--6bdcd7bd-0c41-45ad-9666-d86fdc3e79c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6206a573-0e79-4fcf-a63d-8afebbc46801", "sighting_of_ref": "indicator--05de26f8-4ee0-4ae8-b685-5fdd22d8c6ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3903f2d4-efe2-4579-a6eb-0841bf101ea8", "sighting_of_ref": "indicator--54e18994-a0e3-4894-97c7-2ca0b981aea4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2676bb62-f3fc-4661-beed-5d46234c33f6", "sighting_of_ref": "indicator--64609abf-a7ad-4018-a275-16ca2fbed07b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c76752a-19a2-482c-ba62-e1e5ab22aec6", "sighting_of_ref": "indicator--19d4f440-bd36-425c-ac5d-ad5654be94e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c7e3b70-e4ea-4287-9aa5-9a00e4944f44", "sighting_of_ref": "indicator--c460bf88-d4f6-4497-adff-fe03bd48fcf9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45ecf706-03d6-4fe2-9b03-a3530c1f7f13", "sighting_of_ref": "indicator--5c25f18a-13cc-4f3a-b291-c68dbb0be21a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ddee713-4164-44e1-98c5-6e2d34b5355e", "sighting_of_ref": "indicator--7c6d1998-e1fd-4abe-801c-992b149e3176", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--669ee9bb-edcb-474c-bbbb-0a3320fe791d", "sighting_of_ref": "indicator--de9b63db-4947-44b5-b3fd-a332d72c2ddb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cceaa02c-4fb4-430b-a340-a0d9ce004e01", "sighting_of_ref": "indicator--324a84f6-04b2-40f6-a1e8-40da238d2c8a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0522997-fe69-438b-8503-85c4fc57d161", "sighting_of_ref": "indicator--2d46aca1-046b-46e7-a506-0cda2b9cb616", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29f76415-90b1-41d5-8ffa-4e7361b2bbc2", "sighting_of_ref": "indicator--89fff459-21b5-42cb-976c-d72883bb1023", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6edef4b3-db3e-4553-8a8b-83ac1da2a252", "sighting_of_ref": "indicator--c1871ec7-f8b8-4ea4-a16f-06fe59a40a8c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66918b42-4513-4b93-b29f-e7cb571c9573", "sighting_of_ref": "indicator--14349f2e-0cfb-4a5f-bacc-f8c3410a5673", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0e7845-fe04-4b66-8e48-0293046ceed0", "sighting_of_ref": "indicator--73deb00e-a36a-4e8d-b970-cddca306f6f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d532c313-a42e-421c-820d-b4c928f0c75f", "sighting_of_ref": "indicator--307e232f-c17d-4dac-a945-e62bd0ece437", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ebf9409-3ac4-4904-a5a7-9f1b05cc080d", "sighting_of_ref": "indicator--ff7f91b7-e5ae-4f4a-94aa-0b79391c128c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb3da85-b508-49b7-9d33-843ccb3e8baf", "sighting_of_ref": "indicator--96a8cd5b-57a2-49e3-8042-52fed4e10e6a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0873bc35-3eb3-4716-a75c-caf8124ed1cd", "sighting_of_ref": "indicator--543e1784-cc5c-41c5-901c-40916e7305c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cb7c1f7-4c19-4b94-bfc5-5e580f35593d", "sighting_of_ref": "indicator--f6f1ad5f-9fd0-49ba-85b8-2b9549b04402", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c689984b-316a-462e-8229-2965a719abf9", "sighting_of_ref": "indicator--89a4d789-db72-4365-8690-197b64555f2b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf0627f-35ac-4951-94d4-d3cc24f46820", "sighting_of_ref": "indicator--db86d5e4-52cb-40fb-a424-8423ce72da69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e74a682-a222-44c9-8db4-7dc115e72f07", "sighting_of_ref": "indicator--f58d2aab-dd81-4a86-b566-d0f88f218732", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eac07000-c596-41a8-9215-75a7ab28dcf9", "sighting_of_ref": "indicator--edf637fc-a7d8-4575-a4e0-5cec4516f34a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9a65b75-0753-44dc-8747-f3c131fa9a1e", "sighting_of_ref": "indicator--265202cd-5b08-4c9b-a346-95a659658aec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f074209-7c54-47cd-96c8-bc5ade160f86", "sighting_of_ref": "indicator--9bf52272-92e1-49e4-a741-9e589202b5f1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc22ce7-357d-4bbb-92e3-fd7689dc528e", "sighting_of_ref": "indicator--9c0aff77-3108-4f13-9303-1eace499dce5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664e40ab-5c97-4aa5-bab3-7a077235135c", "sighting_of_ref": "indicator--cef9fbc1-aad7-4d73-afcb-1b7cd6dffdac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baf06df2-7ea5-4d52-bced-27820c6b92d1", "sighting_of_ref": "indicator--dacb4fc9-6c8b-497f-a131-a8243a4bade8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a20a4a19-0089-439f-b865-0c11d02ddc63", "sighting_of_ref": "indicator--de0864b8-488e-422c-80d1-c147923805a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22552e88-73be-4959-bc4f-5dcc06184443", "sighting_of_ref": "indicator--0834ad5c-1788-47a1-a9f6-e90f3fece96f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--714be9af-b18d-4435-b108-e9e6e2813f94", "sighting_of_ref": "indicator--d03481ff-222a-4f27-a331-8e08fdd424ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700fd280-2631-46f8-b256-9be68e6aa876", "sighting_of_ref": "indicator--eeb7a758-252c-487c-b02f-5906a3df4ede", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9931dbdb-a7b9-4e8b-a78e-8ca5f0df6efc", "sighting_of_ref": "indicator--8c4f49fd-790f-4569-b82d-d25b97e62859", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--476f3d28-48a5-477b-b022-28494debffa5", "sighting_of_ref": "indicator--3f702cec-96ef-4951-93ae-4353ab1c59ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d51d64d9-cf16-417f-828f-4d7e95cbc40f", "sighting_of_ref": "indicator--f2aa323a-156c-41a2-9181-5a03c4895e61", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--555d9d6c-318d-4796-b0a3-252d0550c402", "sighting_of_ref": "indicator--f4b83890-99e5-4659-afad-603f69ae1fda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f32a0d-e6ef-4562-b7d9-d15444caac51", "sighting_of_ref": "indicator--9f4af87b-e211-4d73-a800-4e7e6f73bed2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb6be34b-b0b5-42f8-a592-6e4a179df179", "sighting_of_ref": "indicator--66e68a22-63b9-4bcb-a0ea-ab735131bbd6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db63650f-9dc8-4274-8700-f641535d9580", "sighting_of_ref": "indicator--1a82e8c5-1a99-4149-93e3-a84cffa51528", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b3d918b-358f-4d32-ac66-4c7437473ed3", "sighting_of_ref": "indicator--7a2aa9e5-4338-4a3e-b81c-37434ee737c1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4884af60-5de4-45ee-9b8e-a0b3e76eff2a", "sighting_of_ref": "indicator--ec0b5c9e-128b-4fb2-bbe5-96b21b08c8f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b0514e7-d61e-40ec-84e8-bc1c1b5b291d", "sighting_of_ref": "indicator--4a348b62-5583-483b-b751-828e0b29a3e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--514b4bdd-b1a3-4997-be9d-cd5014545268", "sighting_of_ref": "indicator--c03a06ce-26a1-490e-afff-0ee0b21c3cbb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e36bec-8362-4d7b-ba62-618c0a405b69", "sighting_of_ref": "indicator--a090fb1c-21e4-473c-8ae8-72db780cba4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b69ec1a-d22f-4928-9b4b-5355d532e7e3", "sighting_of_ref": "indicator--639fe806-fdc4-4952-a7cb-1619ca581f90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5385e9ae-47a0-4be8-a650-e7493b7ee630", "sighting_of_ref": "indicator--aceea390-6537-42f0-ba1d-7818d53615aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f529b88a-6079-4a61-b251-7a92add5a2d7", "sighting_of_ref": "indicator--50725b94-32c5-4035-aec6-06e0a8178835", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a464518c-f11d-407a-87c5-84e8fd278659", "sighting_of_ref": "indicator--b68d8f90-81ca-4743-8930-c5bfc392dabe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67ccd2c3-561a-4896-a97e-cced0231f436", "sighting_of_ref": "indicator--d39f6b49-90d5-48ee-be1e-93856455782e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdf75f7c-4e61-4848-bfad-b15a5849af36", "sighting_of_ref": "indicator--66d374b1-5185-4d86-90bd-fb1ea1abe067", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7535578f-63ff-4177-9261-c18d005ab9d9", "sighting_of_ref": "indicator--e4be263a-6d09-4f46-a60d-cad007c481d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5787a5-8a5d-4a5c-986a-2d357cba217a", "sighting_of_ref": "indicator--c6a864b4-7b08-4e54-83b8-d8da783386d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6587e40-5b6a-4173-ad3e-a2be42c9d075", "sighting_of_ref": "indicator--81eb456c-a3a9-4113-a78b-e1a58c3ce120", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70aca7b9-c485-4995-b631-0c97b4ffe96c", "sighting_of_ref": "indicator--a66edc77-6584-4749-b37e-00a42f1394e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ab95c79-3fac-468f-b116-7dd24ee017a7", "sighting_of_ref": "indicator--48b0d8ef-581a-493d-8215-03e0da3da258", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa4cc3f-425d-46ca-9bcc-60aa360f7b23", "sighting_of_ref": "indicator--7b7dcc5f-c06f-408c-abce-286b0c87bb32", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20ed8b0a-d17d-4731-90d4-cf7130d107cb", "sighting_of_ref": "indicator--277f8150-a1b8-4fc6-9eb3-4c0c4b498b81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f349de1b-4219-46ac-93a7-e16f7b75749f", "sighting_of_ref": "indicator--5865e9e8-6747-43cb-9ba4-a036c2807573", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54feb3af-0cae-4c81-8bcd-4ad8c7a2536b", "sighting_of_ref": "indicator--d99d4bd4-02c0-43d7-afca-3d052d32c66c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ac5fc0b-34c7-4666-a37f-d791f4886cc8", "sighting_of_ref": "indicator--ee225802-3814-439c-9056-800fa40a225f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a23af3be-c129-4522-8121-eaf6b3d756a1", "sighting_of_ref": "indicator--febd0fe9-ae3c-4048-9fe6-3aeb2b4a8ab5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18bdd98a-d558-4398-82a0-b8817ad7ddc4", "sighting_of_ref": "indicator--5f4da851-7916-4142-bcf1-df3e02b6ac24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c2963f-241f-42f4-8787-28eec09d0804", "sighting_of_ref": "indicator--74f108f4-50d8-4623-bba2-e87cb50a8260", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6caa5db1-47d1-4021-b85c-e9074f7ad6c0", "sighting_of_ref": "indicator--82eddda7-0aed-402f-9037-be6e1e81b006", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--877f0e49-60b0-4e99-bda1-ebac8213cad6", "sighting_of_ref": "indicator--43b26c5b-7eee-4716-a27d-d2a1c02ed8f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faa05b3d-ea56-41e3-9475-55ce0354f3d7", "sighting_of_ref": "indicator--d165b3c2-93b8-43bc-b852-52b96c92ff80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--debc3088-5fe0-462f-8a97-c3292b8c3cd6", "sighting_of_ref": "indicator--a5c4cc62-7e1a-4c98-bfe2-a5c30cc024b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c9daf62-151c-4007-baaf-1457f1518aac", "sighting_of_ref": "indicator--58b08bac-ae24-4f85-9ce3-67a0e6f52cdd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--116a4116-4082-41bf-bdb5-bf8ca9a2de9e", "sighting_of_ref": "indicator--76e19b2b-02c5-45a7-801f-03a5d75e19d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355ba7b3-0af8-4c40-aa72-dfd883f96154", "sighting_of_ref": "indicator--31e8fe21-3b92-4c19-95ad-32097c7c9389", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f05debe3-da9b-48f9-8616-a597a2e43a15", "sighting_of_ref": "indicator--ea74ce68-68bb-4ec3-97c1-7729514c84f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--666ac092-24c3-4595-a85b-c901d43887d8", "sighting_of_ref": "indicator--6ce21777-dfc7-4066-8687-db884c4447bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41520b98-e7d9-407b-869f-525d9a23942d", "sighting_of_ref": "indicator--2328c490-257d-46a0-ba46-d390ed953673", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70a1e8fc-8ee7-43a0-af44-be7efc1f1759", "sighting_of_ref": "indicator--6b1dd6bc-7678-4a99-a8ae-590f2f0f34a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09829063-ac4d-436a-afb0-3aa51059c71f", "sighting_of_ref": "indicator--f61604e8-496b-48f7-b802-e16474db538b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd45db0d-a3e7-4558-9dce-3be511e51a77", "sighting_of_ref": "indicator--48f2348d-cd99-401b-bb30-786ae8b2de9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3307aa-85e1-4098-bebb-3e0bb23207f6", "sighting_of_ref": "indicator--9724ab38-770c-4daf-af42-68434c208b54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ab42b05-0c6f-4390-9604-f3496ab4310b", "sighting_of_ref": "indicator--b033515a-66c3-40b7-8a33-8e63e44865d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a04bc9b-c2b8-4270-8723-fad5bdb83817", "sighting_of_ref": "indicator--2585fdcf-7298-4729-a583-124c05ad1e01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--278f93d7-b1e1-4f69-8915-dc8dfaf55412", "sighting_of_ref": "indicator--ae8dc945-2520-4a4a-b4fb-c8c041f1cebe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab4bd6b6-ad14-4a54-986a-d59551822456", "sighting_of_ref": "indicator--4febd915-e637-4f32-9b2a-088996cad68f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07147489-b177-4b4b-8d34-66b92008c00a", "sighting_of_ref": "indicator--da87ca90-d3be-4348-852c-b3063b0b314a", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30f2bbf9-861b-469d-bff2-f88bd6396a7a", "sighting_of_ref": "indicator--9b98d577-8a82-42cf-a212-43c722b4c540", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--200f4907-2f03-4a88-a68f-99034500edd2", "sighting_of_ref": "indicator--d3512968-d04e-47e1-b356-26e829f4db93", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bebc3bda-a7c7-4734-871b-35e8809044a7", "sighting_of_ref": "indicator--c6b00d74-48cd-482f-aa0f-ee978f57079b", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74bf57c6-ec4f-4e19-93d4-78c3f679f91d", "sighting_of_ref": "indicator--e4413839-4376-4355-aaa2-734cabf3a996", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f78c41db-73e8-47d8-90c6-572b311af7b3", "sighting_of_ref": "indicator--631cb7e3-de1a-4965-9dce-6b7e882263fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cff9b028-ec7f-49ef-861f-3f50d42f1adc", "sighting_of_ref": "indicator--e8dc5411-7ec1-4bb7-9f80-1ebf4c58ea36", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b6568bb-310a-4bb5-8ade-64bbf810f36f", "sighting_of_ref": "indicator--04d97fa1-1a15-4fc6-ac2f-31008cdcaa4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73788d32-ecbd-43b9-a4f0-a426d7472b6b", "sighting_of_ref": "indicator--b4c14c82-a144-488e-bb07-a80d497b527a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80a0ec82-b370-4a18-95c9-2e7b38b71da6", "sighting_of_ref": "indicator--46a629d2-3d93-4ac3-97a4-f342d01ff685", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e14cdd-9b96-4f44-a878-9833137ff5e7", "sighting_of_ref": "indicator--8e9292ab-ffee-4dc9-8959-70cc78676387", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58b43544-dd7a-4416-bc15-8307cff7c24b", "sighting_of_ref": "indicator--45c27f18-d163-4ca7-9a31-9fe03c383137", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b89d9256-9e05-4c55-86ee-c87778dd00a0", "sighting_of_ref": "indicator--ee3eda72-096e-446d-b9be-a976143b562f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ea3a52d-4e01-4ad3-87d3-fe34d1750dad", "sighting_of_ref": "indicator--37577b5d-c328-463f-bc6d-83777ec53d90", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83785eb9-16e0-4c4a-a757-c85bb21f8294", "sighting_of_ref": "indicator--8dd296c8-b55a-46b4-848e-83f781aa3aa2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f628c09-1706-4f84-8b2f-8f0e02023ce6", "sighting_of_ref": "indicator--f375f572-046c-4f7d-bc15-0308baac216e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd31069-f6f3-45d9-b35d-8c1ebcef0ed4", "sighting_of_ref": "indicator--f82e0cf9-24cd-435e-ac0b-f7e1bc123846", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8738ff0-b0f3-484e-8546-53c3b5b89cc8", "sighting_of_ref": "indicator--c5f1e861-9686-49f0-9c13-f48a93626816", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9e61b6-6790-4753-bb57-5d292df82c31", "sighting_of_ref": "indicator--ab584ff5-d84c-4b6b-847a-177edbe02b3b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec81a877-689e-4948-9482-8c0ca4eeb2a4", "sighting_of_ref": "indicator--18469cfd-6a88-4cca-b7bf-f161f1d31aa0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16bfbe95-5f35-4689-abf6-3c6c4ebc23d4", "sighting_of_ref": "indicator--54f35833-cab2-4b2c-bda4-2b940f7c1649", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fff0ac5-ec45-456f-97eb-05b5a023a553", "sighting_of_ref": "indicator--729e9dde-650a-4faa-906e-9a7d5d7d49da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6d8e6e7-bfb8-403b-b97b-da93d8603ea0", "sighting_of_ref": "indicator--edb57862-2e47-4dea-8f55-1628b5e749f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c0a5a3-1a54-4386-bb6a-9b04584ca11f", "sighting_of_ref": "indicator--168180e8-69a0-41f9-a061-8896b0b29aa0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ea51a9f-02ec-4809-bef7-349991213a99", "sighting_of_ref": "indicator--391c83c6-6046-4aea-8b66-7d22403a388a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80571837-7665-4284-8181-38f08cc7f610", "sighting_of_ref": "indicator--23ba72ff-5508-4dd1-b563-ae58dfb807d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca7e39e2-a39d-429a-8d6e-b6a8cdacca23", "sighting_of_ref": "indicator--a6f5e271-4348-4a6c-8215-4f0c369f9dce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d3438d-5710-44c8-b972-67e9966ac244", "sighting_of_ref": "indicator--49d8a277-bd5a-4135-bd30-2d4b4156ff87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10800600-6889-4cc9-9638-7d368fa837fd", "sighting_of_ref": "indicator--c3c6a203-133c-4f67-84e6-0234a13e0207", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106bd33a-866a-4352-aabf-88ec01b74281", "sighting_of_ref": "indicator--fb069513-585d-4ff7-8340-aa73dc101e6e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523afca8-e5b5-4865-ae15-ce53c3c19dc4", "sighting_of_ref": "indicator--49fe391c-aee3-4d97-a52c-7b3aead739cd", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bf94a6d-c6db-40e1-9b51-baa902f9905b", "sighting_of_ref": "indicator--325a3a2a-e8cf-400c-965d-a156b5322320", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5379fca-511f-4dd4-a6e2-330af0305bf3", "sighting_of_ref": "indicator--1fa3c7a8-12ff-4e8f-9d63-09e8df06ee4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6691dae-7b1f-42b3-ad92-e9d4024a84d7", "sighting_of_ref": "indicator--aebe53de-7cc0-46c6-86b6-e2bcfb6ac2aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38a4e89f-b688-4e81-83ba-ddbda3adc363", "sighting_of_ref": "indicator--e2c9754b-1619-4320-94e4-14504e185d4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1075d7d-7135-4add-9667-fe7dd46d387d", "sighting_of_ref": "indicator--5ea76da4-e26a-4a6d-8156-d3012c4614df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eca6831f-696d-4db3-ba62-e57ad29b698b", "sighting_of_ref": "indicator--d1ff6253-a9c7-4591-9254-a803c2b0b969", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6de3adb-e265-4d88-9ab8-875c43c3ee37", "sighting_of_ref": "indicator--f626c2b6-8928-425c-9d1f-417cea395dd1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2130ac68-de3a-435f-b2a8-f034a89028e5", "sighting_of_ref": "indicator--e6085296-fb86-4c89-83ee-08145f2bd1ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d4878b5-d8df-4ad0-b924-4ed6ec47af3a", "sighting_of_ref": "indicator--b2b5932f-2c7b-4e86-9d5c-4f8853dce952", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbad1b61-51fe-42bd-834d-92301daca5c2", "sighting_of_ref": "indicator--8cfea9ba-b14a-48b0-adab-71fb6fc0240d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94ea3bd-c804-42c7-84dd-fba999f84ae3", "sighting_of_ref": "indicator--64638990-643f-460b-adda-1a38fec2e2f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ec1c6a-4f52-4343-9841-1bdcf0cf0f0c", "sighting_of_ref": "indicator--19915439-c154-47f6-9940-42e91dba8c9b", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e059083-6908-426c-8246-3723e32af732", "sighting_of_ref": "indicator--8fead2ec-c3b6-4695-9f76-300533b01d7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fac9efe4-9df7-4514-a320-35ca39887873", "sighting_of_ref": "indicator--997fa5cc-b219-4c6e-9a5c-ff32749daa7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--892c000e-9c65-425c-97af-9605e449a1c4", "sighting_of_ref": "indicator--41b44673-24ae-4ac7-a599-d1e151a902b1", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba319c4b-be85-4321-ba21-c547c7651504", "sighting_of_ref": "indicator--52aa5887-13e6-4166-b152-dd9e86bcdc8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a175467-01ac-474c-9912-d498a233c8e2", "sighting_of_ref": "indicator--3fc15adc-26a3-493e-8d45-06525b7c19fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43bc5941-8ce6-4437-9c8c-989aadf5acd1", "sighting_of_ref": "indicator--15dcd9ac-d12b-45e9-a3d6-e0a5fef916ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f7f2fab-155b-4f11-9376-f769a3dac1e1", "sighting_of_ref": "indicator--e69d8574-78c7-4107-bca6-b6e76af25704", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a2593aa-e0c0-4cdc-878e-7f178ac05ebb", "sighting_of_ref": "indicator--d553d067-06f5-4013-8cba-fa8608185f2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d18f3a57-babb-457d-987d-dfcf4e152b74", "sighting_of_ref": "indicator--a905883f-2d84-4fcc-bbb1-185fc13847fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4328e6af-0252-421d-8f8f-87ba3b37b4d0", "sighting_of_ref": "indicator--f87c8050-ffd4-498c-b559-33ca2322dd8e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d0c04cb-5b24-4011-87fe-a65ddc702efc", "sighting_of_ref": "indicator--b8be019b-ca2d-471e-ab85-17129926f17d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39eaefeb-c4e4-4362-9310-063929f496f3", "sighting_of_ref": "indicator--46e14065-a2a7-4189-bfa1-3426a3f1fb54", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e37b1dd-552f-4fcc-99ce-d07143ca855f", "sighting_of_ref": "indicator--4e86d6db-cbe3-4c60-8162-6f7bcd38ee7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7eb1185-648a-448d-9104-eb8dfc129052", "sighting_of_ref": "indicator--4e8d638c-df11-47b6-a82f-3a6bac1cd695", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--071a3c69-02d5-4ed7-8ed0-19549cb4d191", "sighting_of_ref": "indicator--2f5ed9e8-9e75-49f8-8df9-278065b2e667", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b815089-c569-4b9b-9efe-5ded22adb1f4", "sighting_of_ref": "indicator--2f10801b-e5b9-4d42-af2e-5a63020b7b31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c354c3-c03b-4f4a-a05d-4adc33f835f0", "sighting_of_ref": "indicator--c5d1c877-c55a-486c-a1c6-f8621d6b6bcf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a68e98bd-241f-4349-ac4d-2a4556ca2869", "sighting_of_ref": "indicator--76ce43a2-427d-41c7-81cc-4b3ef6067f92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1215a020-4ae8-4a33-874e-d376a25ad0b5", "sighting_of_ref": "indicator--ef81f9cb-845d-4b6d-8474-306b2ba7dbb1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5270051-b5e2-47c4-b9cb-619e1bee9fc8", "sighting_of_ref": "indicator--0e5c21bf-01a7-4c63-af2e-5931bae9ad4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87591348-4219-46dc-98b8-06378fb45988", "sighting_of_ref": "indicator--3764b167-dab9-4235-97b1-9c5ce9a5fcaf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69235fc1-adac-4c59-8800-4245e9511222", "sighting_of_ref": "indicator--db43f8c5-23ba-4c7f-abb2-38251db25e2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60b3b9dc-4f13-4587-a4e8-cd430ed52d9c", "sighting_of_ref": "indicator--7d4a1892-c9b2-45a0-ac6a-909b6a3ce20d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07a74def-2c25-44a6-af54-a14bd99f56fa", "sighting_of_ref": "indicator--67aefce7-9c5d-416e-aa6b-9c3e7d832a3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1885290c-93ef-434e-a2c3-31e8199a9a0c", "sighting_of_ref": "indicator--503b329a-7359-4356-9117-044630530630", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b611b77-f297-4810-9bfc-c3b674876178", "sighting_of_ref": "indicator--e60918fc-9e47-4956-8cfe-fe5c19a5f001", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51d435e7-99c3-4c5d-9f68-3869ef3864d5", "sighting_of_ref": "indicator--cbacee14-281c-45e8-ae9a-7d5d4fed7642", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31d33cde-61ad-47b5-a9e9-78843b62c877", "sighting_of_ref": "indicator--28027e83-47fa-4eee-a823-20a8b2ca8629", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--988033e3-ea98-4134-99d8-164cf36de974", "sighting_of_ref": "indicator--05777072-4670-4471-8423-899aa9399e50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4545233-668f-4522-a83b-3c4f675a1ada", "sighting_of_ref": "indicator--98ae59c4-834a-4194-95d5-14fe731554c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c36a628-7a9d-4fb7-98e0-476086e14e56", "sighting_of_ref": "indicator--c5e944f8-182a-4360-8aa0-60e78d711265", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a79cd024-f610-448e-8faa-ee8ceebf86b7", "sighting_of_ref": "indicator--85b296cc-b1b3-45a7-b787-bb0710d18de4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719faf06-d37d-4445-a421-d1f139dd0380", "sighting_of_ref": "indicator--7a0a2319-de3d-4552-b7e9-0dcbe71b3272", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a32123d-8d5a-457c-a081-ec22577adf2e", "sighting_of_ref": "indicator--596638d1-a2f6-4d7a-8ec1-267f59640c6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3a04be-4962-4d58-a72a-9fde4fa4b903", "sighting_of_ref": "indicator--c364aaea-bd78-4fd0-b07f-dd1baec3af61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adbfaafc-10aa-4454-bee3-f4df39492fd1", "sighting_of_ref": "indicator--fbb0bd05-9b4e-43bd-b7a9-d5e78b50887f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57616898-935a-43af-8bca-7f554efbe7bb", "sighting_of_ref": "indicator--b15d20a7-ae71-4e1e-ac0e-470e5cf20a28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0924e03-6eee-43dc-b1e7-87e71335f7a8", "sighting_of_ref": "indicator--f26e2e54-6698-45aa-973f-a7debfabce2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72cc0e5-7a4b-4deb-89dd-eec365d0c977", "sighting_of_ref": "indicator--c66cc51e-8eb6-444b-9a77-675182d5c543", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21d6ef67-09b9-4d93-8c3b-b420f59f0d33", "sighting_of_ref": "indicator--a5dba0ba-7e25-4f34-ae46-124b6d6ddf55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eff6847e-8dbf-43e4-8f02-42b6f4acf715", "sighting_of_ref": "indicator--b32c3ca4-f149-44a8-a119-a9189a612d25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e09d42e-6367-4846-b4a0-da87fb8d68fd", "sighting_of_ref": "indicator--f4d080f2-df11-4c07-904a-7b16c98525c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dce4457-8dd6-4291-889d-1619876ecaa2", "sighting_of_ref": "indicator--31e33222-627e-4bb6-87b7-e15796e09b6c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15b992d-7a61-461b-9aca-5db1d0284e21", "sighting_of_ref": "indicator--cd3e4ed3-5128-43d7-937f-097b6f6bc1d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9f5a71e-cbea-4fa9-a821-676a3ce3b3a1", "sighting_of_ref": "indicator--c01fdb58-6ca2-4c57-a5bb-157e05f37d13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f20939a-fed2-4195-bfba-b431c3adb598", "sighting_of_ref": "indicator--0edb2a26-e3a7-4877-9ab9-990ae71bf459", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad55b72-b0cf-4667-907f-2eec02887909", "sighting_of_ref": "indicator--a23cd016-803a-4d4c-83ed-21a5fea90398", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be08492-1ea8-454d-b4a3-22d05aa0b790", "sighting_of_ref": "indicator--83ffc4ae-3aeb-4b87-96e0-f321eed463cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a101fba-47a1-4216-9937-b1f1a93b7545", "sighting_of_ref": "indicator--1ba53e30-9203-4738-ae1b-d6e752df8141", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce1b9d5d-822f-4c47-b92b-f77aaa5acb9e", "sighting_of_ref": "indicator--dd4ade97-595d-4f11-8d83-ecb532f0051c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15505618-7243-4c42-ae42-89ff5ba527e8", "sighting_of_ref": "indicator--6814685a-8978-41c9-a32f-68e6f8b22269", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--108866bc-89f6-45ff-8b8c-794011c4d007", "sighting_of_ref": "indicator--d284c0bd-8570-4f55-a4e5-908e20e43ddc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32968041-ceee-4d32-b757-0c996898e745", "sighting_of_ref": "indicator--18b79bd5-ec5f-42dd-bb25-9fed097127e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24d1f6ff-bcb4-4de8-89fa-36e885247048", "sighting_of_ref": "indicator--7a28df4b-9b51-462b-bf3c-5cb2b86455ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3def47e7-de7e-4252-8af3-1333913e6e3e", "sighting_of_ref": "indicator--80e274ee-b602-495f-ac38-a188f8539870", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b12c28f9-c8e7-4b0f-90f8-1974946313da", "sighting_of_ref": "indicator--bb526c04-dfa1-4234-b6dd-80773326f267", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63a5d80e-3b9b-4d9a-b735-8fa278f3e34c", "sighting_of_ref": "indicator--4a69be44-e1aa-4c15-92f9-18b4768070ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24a65f40-9e49-4f58-be31-253e6777ecff", "sighting_of_ref": "indicator--2972d71c-7482-4d0f-b9d6-4e8ba0f18520", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b3dff6e-a6ec-43fe-bde9-faed806e1e73", "sighting_of_ref": "indicator--8a294523-8162-4a03-bedb-e1132af4cad7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4afdf53a-0e7f-460c-9f19-9ccd6b3763e3", "sighting_of_ref": "indicator--3cc196b8-92f2-4384-957d-9a5e0149f6c5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de36f1c5-e963-4351-9ff5-779bae7c4d07", "sighting_of_ref": "indicator--1e96569d-e34e-4013-b569-bf0a2c3cf241", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--671d95d7-980b-426f-8a77-26c3045bc485", "sighting_of_ref": "indicator--2b6e3884-8cb8-4fc3-a8b0-d48f6c7b458e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf1e1a21-196b-4bc0-86fe-df5b9fd6508e", "sighting_of_ref": "indicator--02576a38-d142-498c-ba5d-b051d5a264cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e86132-93ae-4e61-9dd7-6dbe2e336a71", "sighting_of_ref": "indicator--7d440032-34ea-4122-a2b3-9539c79849e1", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--232ca418-2877-4c61-95bc-74d480eb318e", "sighting_of_ref": "indicator--8c30936c-aee2-4ea4-bd39-843c7ee6a430", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a5ea6be-668b-4427-a423-742bcf08c677", "sighting_of_ref": "indicator--b7adfa89-e71b-4e9f-913a-4fd8ed75e714", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3ae3315-bccf-4c67-8455-e033f45e1fcc", "sighting_of_ref": "indicator--23109063-19d2-4226-83b4-edba71933b65", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eeaea93-2db5-47ea-bacf-71cc847bf59a", "sighting_of_ref": "indicator--685ee17e-638a-4d45-afd7-f748361b1b9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a22a8e-a85b-4622-a689-adb38b7294b6", "sighting_of_ref": "indicator--c3976005-79d0-497b-b2f1-aed7d1cbf7e4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9ea55b8-770b-44d3-9df3-203db4712f91", "sighting_of_ref": "indicator--540bc0db-d268-4432-a8a6-8e94af3a7201", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f05e81ff-515d-4fa1-829c-36c2f0970c2c", "sighting_of_ref": "indicator--6d02a526-a74b-40b3-bab3-4bd1e92e9c46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--425e2d87-7033-43c9-b5fa-7050610c4178", "sighting_of_ref": "indicator--11ad900a-ea83-4782-88a1-666c671f0c79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51961c1c-4e2e-417f-8c8e-fc32c8d68e1d", "sighting_of_ref": "indicator--aa6be721-c7b0-4f82-a2a5-21459653d7aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45dc642f-1c30-4061-9adf-4d31e6457283", "sighting_of_ref": "indicator--d6058f86-1b85-4596-9514-77964ec2293d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f2d145c-fe72-4a10-9880-b7e86e55717c", "sighting_of_ref": "indicator--c3f2d0c2-f372-4530-a0f7-232e03b20004", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03bf26e7-9767-4a19-8460-cdea78ff31c5", "sighting_of_ref": "indicator--2ac53495-d3b4-4376-af00-804380eb5b08", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a93bcb6-f1d5-4954-8ae4-18c38c5704c8", "sighting_of_ref": "indicator--27951cc6-b90a-41e7-a728-2a11c1921232", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d71e761-d8b6-4936-9960-6bf1776780b3", "sighting_of_ref": "indicator--23ce6881-455e-4d59-b9d0-78ed56af029c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed206655-b14c-4566-8042-5d78ea34af0e", "sighting_of_ref": "indicator--b1440cba-6a6d-4b76-852b-f84ff5ffcfeb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a799c3fd-d384-4005-ba32-de97c4e4a664", "sighting_of_ref": "indicator--1a65e73c-ed14-475d-ae4c-bfbaf54e9c48", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c939a1c6-457a-47e6-9641-bce8df671659", "sighting_of_ref": "indicator--c3d9db1d-9dcd-4b95-b12f-f7b860600a3b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9244455c-12a6-4b0c-b788-b50d49595496", "sighting_of_ref": "indicator--2f93820a-5c3e-4122-9934-9e4e39292c5e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39e486af-7dce-43f1-9dce-b567143d666b", "sighting_of_ref": "indicator--cf1407ce-5b1a-4f8c-9d6d-95a4d3ab1432", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f47996-d6df-4432-a7d0-be5f513215b3", "sighting_of_ref": "indicator--a3494d34-ef62-4ff7-9382-e367c796c6e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a46c4127-3c1c-46bd-a9ec-d40ed2b3240e", "sighting_of_ref": "indicator--f96d3438-ff37-4120-a3d9-97b07dd1a72d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--476b2c7c-f174-4c48-8d11-50751a92ea82", "sighting_of_ref": "indicator--b644d620-4765-4630-beb0-aa6fe7e74351", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76922386-c4b0-43ca-9a24-a04e4d5e7325", "sighting_of_ref": "indicator--ec99a037-d2f5-456b-80a5-95989e4b5676", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e82867-f56a-4068-bb86-d0cf624569e3", "sighting_of_ref": "indicator--f8be9915-632b-4bae-a64e-00010d9cb882", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07734d62-6fb5-4d6b-9183-318268d3d8fb", "sighting_of_ref": "indicator--46d56ac0-d26e-42a0-bed1-8559874e56b7", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8de55e4-32d7-437e-9634-b60607e4b8e2", "sighting_of_ref": "indicator--4d68e3d7-5a06-46db-9c09-d769c7e350e0", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acff1b5c-5852-4b06-b0df-cc84f4cce95c", "sighting_of_ref": "indicator--76c81fff-aa43-45dd-a26c-4d6dc79d3823", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d768666-eee1-47ad-aa4f-07d82560ce1d", "sighting_of_ref": "indicator--2c0467f5-fd2e-4b88-bdf0-a5a72d3d509e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff9dd2d2-1287-429d-b22c-005eb8545588", "sighting_of_ref": "indicator--603fa7bb-4dc6-4865-971f-29a544f27d0d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0856308-6946-4793-89e5-cc0aff45b36a", "sighting_of_ref": "indicator--1657230a-b096-41ec-a936-11672be05f0a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5e56c07-da2c-442b-97b5-2dfeff312b30", "sighting_of_ref": "indicator--a9d9dfb9-9262-4615-8836-893e0d323075", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4be313bd-4dd1-4b8e-afbc-17f116b0dc5a", "sighting_of_ref": "indicator--785d06be-80ea-4800-a635-0e085a614a14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de869b9-d68a-4043-b75f-b0e71445aca6", "sighting_of_ref": "indicator--397e4df8-7b5a-49f3-bda8-06750a536787", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27eb711d-7542-409f-ae4e-03b06be3f885", "sighting_of_ref": "indicator--08095e47-afa8-4d07-b14a-770bee161e1e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5996b4f4-f842-4a26-b190-2da7bfdad952", "sighting_of_ref": "indicator--a7c4bde9-b001-4147-b2b2-090d9d7c3de2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9bd5a2b-18c1-4c38-b7f9-2c7eaf6e7089", "sighting_of_ref": "indicator--9d28a3c6-fd8b-4399-8e54-4d72a630a345", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f9c6e0b-f243-4c50-a1b9-5c05109bd855", "sighting_of_ref": "indicator--30e1cc29-93f2-4e3c-9891-1378a958ecb0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf0a0a9-b100-4773-aa18-9c4f0c0c8448", "sighting_of_ref": "indicator--ebf69aa7-dc7a-4d2b-bd95-d5f976d57fef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0750828b-2abd-4e8c-ad38-aec68b3b2752", "sighting_of_ref": "indicator--da80bdd9-48a6-4710-ab19-df09866b9f20", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46cb7bba-2f18-4931-96a8-47249fd3b3b7", "sighting_of_ref": "indicator--4362d435-a1ad-4494-9c1e-cadfa3c0d330", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff24e1cf-c78b-4245-9a8b-7dc482d26b5d", "sighting_of_ref": "indicator--4d4e601a-0d1e-4c18-bbe5-83f24f87f057", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd903ffc-9074-4179-8c10-e67f9cc23956", "sighting_of_ref": "indicator--720128e4-8401-448b-a62b-5049b98c3e72", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68991eb2-17c2-4f27-b44d-6837f760bcb2", "sighting_of_ref": "indicator--79f37619-8f9b-4f78-b249-eee459d54538", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ef2499a-ea6b-4c39-8c2a-047295051ea5", "sighting_of_ref": "indicator--21ae3b71-4798-449e-8a91-ba3c3f32a240", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4ae1932-026f-4a9e-87b1-95a212ef60b4", "sighting_of_ref": "indicator--866f23b8-9feb-4b63-9108-1693d32453c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--001e5292-a621-444c-b92c-82fc76646d27", "sighting_of_ref": "indicator--6975c56d-1744-4605-afb9-aa2a66df90ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--515c7f3d-858e-4e26-9f3a-e5fc3e4e740d", "sighting_of_ref": "indicator--2c491696-dd88-4809-88b0-0f90b9629509", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef8a5270-94f3-4332-aa9f-fab949c406c9", "sighting_of_ref": "indicator--e2c4c7af-348c-4a84-9475-4dcf2dd82161", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68eb511e-0845-4c3e-9a71-b231af78623d", "sighting_of_ref": "indicator--905af4a0-b4da-436f-b1a7-d6d3ace1166c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1f19568-ff68-4404-b0b5-0e011870f937", "sighting_of_ref": "indicator--f116bd36-8036-4c84-994e-fc35213c75de", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f718b57-a19e-4c6c-abb7-e28c92a1a1b7", "sighting_of_ref": "indicator--bce56314-ea67-4530-8f0d-ce5f612eaa18", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26542bd1-dd62-4f65-b906-de35fd70c1be", "sighting_of_ref": "indicator--fe64177b-3448-4b44-81a5-d706862b2872", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32886ede-4e39-4f72-8bab-f3df89999bb9", "sighting_of_ref": "indicator--d698e2ac-ffe5-4753-aa82-a5c390caff45", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa50fada-88ef-4781-b6da-c0d6b2f0019c", "sighting_of_ref": "indicator--bf1d95a0-5845-4491-b679-f1e7e8d3d4fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eae84ce6-b5ca-4beb-bc3a-02229aff654b", "sighting_of_ref": "indicator--8f1f91d6-acea-42b8-94d9-b8c2e47583ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc115cf2-8599-421f-8f5d-d9206692f45f", "sighting_of_ref": "indicator--f9bf59b6-4863-40bf-9183-deff9586c141", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--717a8f3b-1505-4163-ba8b-ec7ba193b337", "sighting_of_ref": "indicator--7ed01d3a-ea3b-431e-a1d0-57c729f4f5b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b42ca026-7e66-4d05-8cea-00e2e10e2dec", "sighting_of_ref": "indicator--3be8caac-42bb-463b-a31b-7a43c23b52d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--000dbf67-136f-4495-bee8-7afbbea82e6f", "sighting_of_ref": "indicator--33a23dee-2f43-4a11-87cd-60a21af6eb1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b3e547-73a4-4b0c-a058-3b6c2eb4a6e7", "sighting_of_ref": "indicator--666e6eee-f5ca-4804-9e22-06eb2216bda6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90234e20-122e-4d29-af3f-831554a03e2b", "sighting_of_ref": "indicator--a5bda2c8-e20c-4378-8a38-ce079164065a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--879ab22b-ff56-4df4-ac07-e52c8386b8a4", "sighting_of_ref": "indicator--22713847-afad-49f7-9935-8b70d999598f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b83123d0-9ab7-4f35-851d-84cae8d2de91", "sighting_of_ref": "indicator--4e1afd06-89ed-4887-ac38-c477916fbfc2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a57533af-b9b5-4796-acd3-8d5750b8ef29", "sighting_of_ref": "indicator--8ae8200a-07b3-4097-98ec-7e8433176b5a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--333e81ee-d67f-4d1d-abe5-de4e5fbb82db", "sighting_of_ref": "indicator--79e31163-a426-44cf-8c2d-0e30ffe2f348", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70188741-8084-455e-9e4c-55a866a4be71", "sighting_of_ref": "indicator--ece1bd0b-4fd5-4d39-a845-b66ea7b68bb8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07774807-ebc7-419a-a063-b2d9b14ac673", "sighting_of_ref": "indicator--88a33604-25b8-4622-8d9e-d41736236dc4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87653262-382d-45a9-99d6-63d8e5738e0e", "sighting_of_ref": "indicator--b7931382-1b45-49c1-ab4d-dd7c419b0d57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4edac1ff-2f53-4306-8389-7ff5c6042fef", "sighting_of_ref": "indicator--12757617-d683-47e7-8ef1-2e21a418195d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7c6c372-f888-4177-ab15-be8a357c1d2d", "sighting_of_ref": "indicator--71459f02-a6ff-4963-afae-1a368f1b4d51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77bcf551-f3c7-40a8-ab3c-6e89d7d49f79", "sighting_of_ref": "indicator--f35f551e-2d21-41f1-86c5-a5f6d4b7f4a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ea437e9-5b3a-4f66-8dbc-91bef8aec0d1", "sighting_of_ref": "indicator--4fc78434-77c0-43f2-886f-54ccaa84b5d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68fd84ca-7c17-437e-9b2e-560b07b0b5ae", "sighting_of_ref": "indicator--d3756e37-68a6-4ed3-bb2d-1347a1d3c982", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47bcc2b3-4ec9-4848-a275-3aae05fbd142", "sighting_of_ref": "indicator--bc8e97d7-45c5-42be-b34e-18e9f8da33ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb47f463-9965-4684-a88d-6cda18c90717", "sighting_of_ref": "indicator--7082fa86-7519-4aa4-b497-ed044b288816", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f163598-18f1-429f-ad6f-1e120fdb34f0", "sighting_of_ref": "indicator--c42b7904-0196-4c47-a2a9-4bc09745b1cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57a9266f-0e9a-4c9f-acdc-24dc3804ada4", "sighting_of_ref": "indicator--a27d014d-8990-4994-8006-b0d3cc622979", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c25a941-368a-4f0c-90bd-03d5f7558f48", "sighting_of_ref": "indicator--473f662e-6374-4db4-80c4-cfe7a6971c90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f48241da-3480-49dd-bf3b-efcfc8d484d2", "sighting_of_ref": "indicator--0db8f687-875a-4e65-8d81-2956071423e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06cbb827-a404-4582-a293-f2d2d4602ad9", "sighting_of_ref": "indicator--4e91550c-490b-4691-8ab2-e63fac80849c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e4df952-972e-4e3a-9d37-795cacce6e1c", "sighting_of_ref": "indicator--2a87138a-aee1-4344-8601-8e393f6785fa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cb82f8a-e270-4d6a-8ec7-1f2b099a7e45", "sighting_of_ref": "indicator--74706b85-100d-463c-802b-971dc925361d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3cde0e7-65d3-4c12-ac44-7f38cafb759c", "sighting_of_ref": "indicator--de66576e-288e-4a75-bc10-98bd678386e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c577b3-709d-406e-9cb1-9e2f5bce5d0d", "sighting_of_ref": "indicator--38689fe9-de59-4b42-b4c6-05060d3eaa07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17bf9e18-5f0c-4722-a9b5-a9fc183db6eb", "sighting_of_ref": "indicator--10d6bd6b-39fe-4f18-88d0-5d18e5456d4b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53cc5fe8-36b0-47ac-9143-89daf5a73772", "sighting_of_ref": "indicator--f16fa3bb-a87d-4e0e-bf9f-712babb3d865", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f538242e-f774-4d02-9efd-751c574363f7", "sighting_of_ref": "indicator--bb55339a-74bd-48e2-a1e5-27486a6228e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba97b0b5-223e-4902-bd98-e6d2a47f660b", "sighting_of_ref": "indicator--2068d787-b62e-4ea5-86cf-75bc2e7aefcb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e303414-cc3e-4440-aa1d-6b4a5b067f98", "sighting_of_ref": "indicator--7a0680fa-d90b-4db4-9935-62569b5285b6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fa12532-e62d-443b-8afc-7706fa5ae763", "sighting_of_ref": "indicator--402cd15b-1c3c-4bfb-90bd-faf98454ef85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b9a4b90-d833-42e4-ad0f-edf56d7fbd93", "sighting_of_ref": "indicator--bd2f1191-1c6a-4f54-93fd-e2b99452279d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18320c4b-d494-4777-9f5d-2a0a469fd5e0", "sighting_of_ref": "indicator--5980da60-0ab2-4cbf-8ba9-69e3af65589f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f24b1ab-d1a0-43c6-afd8-e649629ba158", "sighting_of_ref": "indicator--a451d683-2480-4cad-8d13-00b48a1a8193", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--570be7ad-41ef-4541-bfb0-4bcc43b39908", "sighting_of_ref": "indicator--a284d34d-bb81-4dfc-ad28-6b5000f48072", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d654a78e-5944-46d2-9356-d99a211ebe58", "sighting_of_ref": "indicator--b12c61e3-b3b9-40bc-a08f-bc076ace4428", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0147d034-1c5b-42cc-8b5e-2f5e5ecd7730", "sighting_of_ref": "indicator--5a7bd6e7-004d-4f3f-8eef-f6a9f73cfe5f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3cce2d5-d3ed-4aa6-9bc1-8c3bda0954db", "sighting_of_ref": "indicator--76c7da8c-5b7d-4f4e-9942-b18889c6af18", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a8949b-2946-4be0-9b92-08411b4680aa", "sighting_of_ref": "indicator--020de442-1c86-4a3e-8440-b73e69f5b0ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--606753f7-1bc4-4ac2-a785-ff17ed955fb1", "sighting_of_ref": "indicator--1813322c-ab9b-4d04-9b79-f3e78493a6e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8767d7-8ac9-4b7c-9c28-b8e269bd2513", "sighting_of_ref": "indicator--58675c7e-4270-4bc1-8651-6e6024745a4e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e26e4098-9887-4ae3-ba88-0bda04ecea88", "sighting_of_ref": "indicator--1acf9cb4-b726-45fa-b876-affe62d1e7ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc7e9e6-2e4f-4942-861e-d54b1a22fc8a", "sighting_of_ref": "indicator--fa77d01e-4210-4e61-9ef1-6389b8aa73f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9f24591-f527-4d63-bed3-f3026c59915e", "sighting_of_ref": "indicator--95c8238b-e33c-4485-ab0d-0bad2fcc1fbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31216194-438c-4d07-915a-2afd5eecc9e9", "sighting_of_ref": "indicator--7ab5753d-af1e-49bb-a88e-7700a84c4190", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7fe308-a225-4da9-b7a8-705746be3a67", "sighting_of_ref": "indicator--500e7c8f-3db9-4ceb-8c90-ce726a58cd31", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7318bfaa-8f0c-4610-8688-c86299c0115e", "sighting_of_ref": "indicator--78e8f0e6-b724-4551-8fa0-f869d6ed5a4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4673a48b-eb7e-4126-af69-1978819f6243", "sighting_of_ref": "indicator--337b300e-703c-47e2-b481-6a3bfa70800e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51c2aa60-c97c-4db4-9e0d-fea2110bfd96", "sighting_of_ref": "indicator--13bd55e8-dd1c-486e-99ba-fd3a028f7f46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0c419f3-283b-41bb-85eb-4c5ac4b1db0d", "sighting_of_ref": "indicator--02c4a6c8-ca41-4a1c-b148-3571a4957538", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--586194ee-95cd-45e2-97c5-7622bbbc68c3", "sighting_of_ref": "indicator--dce50abd-4139-4d05-8f58-bb7c8755b100", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf117e3-083c-4c9a-bc4c-52898498c7fb", "sighting_of_ref": "indicator--aef3d773-819d-462d-93eb-80d5229b9ad7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25e9d28a-2988-4b0d-9038-d7939af6c9e3", "sighting_of_ref": "indicator--689a7f27-3cee-44c0-92bb-efbf0b9c0e41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3927ef-8694-4aef-a560-5fc97a1b6049", "sighting_of_ref": "indicator--30ada8a5-2839-400b-9b95-11eb2ae915a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7720efd-6017-4956-a76b-43b1cbdce491", "sighting_of_ref": "indicator--303c5480-2461-4a10-ad30-66bffe2e325a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d8495b6-0d83-41a8-8615-d3daa72c5682", "sighting_of_ref": "indicator--5cf3761f-3183-4e01-96b3-9fb44c4ab9f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edbb4fd3-9214-4656-bd85-cdfec477c16f", "sighting_of_ref": "indicator--cddcc486-d8c8-4c49-887e-235f478e1813", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064e3a39-8868-464e-9688-bf0a7c4f910d", "sighting_of_ref": "indicator--edd19ff3-0d87-4512-a876-d6e7dce4494f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbac2a86-d0ec-41a7-91fb-fbc579eda1c3", "sighting_of_ref": "indicator--f0df19e3-8315-4d1d-96b2-cb2a0d60966e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a849d0d5-de81-47a4-8679-f229f775af19", "sighting_of_ref": "indicator--b6d31b17-42f7-4c45-a485-3ddefa022482", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3786eaa4-0922-4ddc-b013-1e1c4d55de3a", "sighting_of_ref": "indicator--76e43c1e-0492-4cd4-95c3-b9ab51067aa3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a90e7c5d-4cac-4114-8d81-13759be38de8", "sighting_of_ref": "indicator--3f193861-34d7-4576-8672-77af109ee6ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163e1dc6-a196-432f-abf4-0f2fa3db1e29", "sighting_of_ref": "indicator--cf2d95fc-fbca-470a-a9a5-a7e03a27d28b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffb6b1ac-6666-4c13-b129-7171acc8bd20", "sighting_of_ref": "indicator--99e88e97-9c29-4614-b722-07b30a968aa1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c780b6c1-bcf7-41da-890d-7899350d3e5e", "sighting_of_ref": "indicator--973b4dec-25f1-4868-9f83-6ca78801a5cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78288850-e763-4e50-8415-205ef2cc0584", "sighting_of_ref": "indicator--7dcec7ec-2624-451b-964e-7d934eb3be66", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb79c07-0713-48c6-98d2-e971d2768516", "sighting_of_ref": "indicator--7714de76-438a-4e39-9f63-6918e62da333", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c05d661-06a4-4066-a213-238fa32b686a", "sighting_of_ref": "indicator--f57f68b4-6ef3-4db4-8f03-4502994820f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0175d999-d758-40f0-ae1b-f79c4bd7e4e9", "sighting_of_ref": "indicator--f71c1e62-d6aa-486d-86dc-8fb82c7c0f0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6396d98-0a64-46fd-a232-49cb96622033", "sighting_of_ref": "indicator--ac13a45e-e40f-4a2a-8815-441ff194104d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb129c15-385e-441f-9a80-4d1651330efe", "sighting_of_ref": "indicator--7757f9ee-cebc-439e-b910-f9368acea53d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a2f9a9a-d83b-467b-8853-779fba755b8d", "sighting_of_ref": "indicator--c9ce646f-68ad-4650-864d-1c9070d035ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb78fd5-4e40-4caf-9f15-a4dee057f58e", "sighting_of_ref": "indicator--cdd823b0-1c9b-48ec-b803-179e77db8565", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5687676-80fb-4a37-8513-9647b5e88421", "sighting_of_ref": "indicator--59f719dc-3e15-4a78-81b2-6713739e7caa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b75b2b90-f4cf-47c0-bb5e-70362aaae331", "sighting_of_ref": "indicator--bb59f01e-8ca3-4559-b761-255fe087a63d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2bffe5e-e929-4750-bffb-81a55a573331", "sighting_of_ref": "indicator--c6f0c611-e5d8-4ef3-b143-15bc522ab264", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd4e58a-506d-4eb2-a3a2-952ac28cfb7c", "sighting_of_ref": "indicator--9de62f2f-dd47-4ed4-866d-dcbeaf3dfe97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42d01e3d-197b-4d3d-ac73-361643a2a305", "sighting_of_ref": "indicator--a920a6a5-b031-4f11-8ebd-752aff05a678", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e502821-8bbd-400d-ba4b-7fad7cbeb6ce", "sighting_of_ref": "indicator--1d159b07-9133-47cf-831e-fb7ad2e10f15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e47d3b0c-913c-4e95-9308-a9153426d766", "sighting_of_ref": "indicator--86c86233-1d27-47ad-aade-c5b393930b4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f74c680-2125-4f86-bd85-40e77d54c7fa", "sighting_of_ref": "indicator--e7b94e45-0588-4989-9e06-705a2f9034f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba386a53-1aff-474b-aa75-ba6ea842eec5", "sighting_of_ref": "indicator--7e17bf82-278e-495f-bf4a-85ad8a71f708", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03606e02-e86c-4f1c-b8d3-19dbbd320858", "sighting_of_ref": "indicator--716cd433-71fb-4984-9d4f-59a2d7e8e48c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d3737c4-a910-40e1-b2ac-14fcd25bdb95", "sighting_of_ref": "indicator--2dd1c92f-b4e1-4124-b58d-fa835bb6a95e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c21ea0-6d53-4c5a-a9e4-bd84fa6154e4", "sighting_of_ref": "indicator--4e59bb53-94f1-463b-adb6-06e406b7bce2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da09777e-255c-4873-91b6-01d3734d125e", "sighting_of_ref": "indicator--fdc8cf4a-4df5-47b5-b1d7-dad7affad6ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--573d76fc-3631-4bef-adca-4fe679565849", "sighting_of_ref": "indicator--5fdf7661-aecc-4e75-8196-d730b633cfb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d542f41-027e-48e1-8b0a-4c236317721b", "sighting_of_ref": "indicator--ac40b12c-e11b-4c6a-8b94-cb50da0dee26", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16708a8a-254d-4179-b84c-04ddfd86f0a7", "sighting_of_ref": "indicator--17e9cea9-74b5-473d-bc69-bc44960e1b1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27b13551-2bbf-44b3-bb0e-0ec7b3167a97", "sighting_of_ref": "indicator--5b872785-032b-4b2f-81f0-569d861e103f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d32cc283-aad4-4848-b883-040a9b04dd36", "sighting_of_ref": "indicator--10bca74b-d9c9-45be-a08d-8aaf1e6130c7", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e992a8f8-456f-4200-b097-caff0d1f8972", "sighting_of_ref": "indicator--8e072c74-2229-43eb-a277-ab5744a63386", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80161581-275d-442b-9af3-b1864b543f75", "sighting_of_ref": "indicator--51e27daa-6e2f-4dee-a815-7c84aa214010", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ececd3a-5a71-424d-b3e5-983625faee5a", "sighting_of_ref": "indicator--58c2f2e8-3b0a-49b3-a6a2-c4dba3245e16", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8597e7b7-7d47-473a-b687-7efa1e102fd7", "sighting_of_ref": "indicator--40e30f6f-573f-4f6b-8fee-8627b7982973", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3877a52-0dc3-447a-8f8a-38a553708e72", "sighting_of_ref": "indicator--19e1ca2c-e5d9-4caf-ba29-11e85549c13c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4d033b8-979e-41ea-ab4e-42ffde65b8c9", "sighting_of_ref": "indicator--fb73fa1c-e67e-4927-bd5f-5e71d6947ceb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cad3ec2-8d89-4830-a416-d9765fb26566", "sighting_of_ref": "indicator--853dffbe-6851-41e9-9aa5-36fd157d0fee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2acbf7a0-6782-45c0-b27c-217c1313a856", "sighting_of_ref": "indicator--28c876f1-a251-4a63-a9ce-e60d15817ca8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51da44fb-0bf8-476c-b89f-6916f0ecf529", "sighting_of_ref": "indicator--a04e4cf7-39c0-43b9-8ecb-c534dc241b24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d9b4fb7-7fde-4389-a2a8-a1bad21f1d18", "sighting_of_ref": "indicator--8efeb5d4-bba4-49ff-8bc0-79a424e7c569", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74d5a2df-a24b-4c23-a6a6-7b70c8a47e45", "sighting_of_ref": "indicator--0831a76a-797f-4944-abed-daa400400d6d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f2fddc-7f42-4f73-8f1c-ff2c8ef0f625", "sighting_of_ref": "indicator--4d55c56e-34da-4021-b067-5edc7df3967b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b33194c-b157-4a87-9de2-12607a9d3864", "sighting_of_ref": "indicator--56a04648-3dc1-461a-a7dd-ff8785179d89", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cc3faa1-10f9-4eaf-bbce-fbeb50a4ff35", "sighting_of_ref": "indicator--50cc0261-3d93-4494-bff7-4d59cddc6bd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4a171f1-7050-4f71-aefd-60ccfef8a9e7", "sighting_of_ref": "indicator--79219928-dbb9-4d30-a307-722e95345091", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72fe396a-8023-4f1b-9169-5453d5826fda", "sighting_of_ref": "indicator--703e2f48-3824-413a-b5bb-e5a35671c132", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78fda34f-ceb5-4638-9abd-b0b5e45c6d5d", "sighting_of_ref": "indicator--5aac7353-2b33-4e6b-bccf-57a4e1910a01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d56acbc7-30fc-4d07-84c1-2f76e1a7edaf", "sighting_of_ref": "indicator--05510af5-0a99-402c-b6b2-45c7fc42ea15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fe453fc-ae20-41f0-8150-e7089ba5a892", "sighting_of_ref": "indicator--73b279ec-db1a-49d0-a009-2bb700f16ffc", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3ef85e4-f3f0-4900-90bc-553331ea5234", "sighting_of_ref": "indicator--89827c2b-da47-4f4b-b226-a362e255fb65", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93db6b49-c31f-477a-9467-825a08978cc3", "sighting_of_ref": "indicator--107802a1-dae6-426f-bafe-e9b17e250de5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a961f682-ed44-4138-aaaa-6aa174756b2e", "sighting_of_ref": "indicator--107802a1-dae6-426f-bafe-e9b17e250de5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60826336-3819-4c28-a654-aef8e812c74e", "sighting_of_ref": "indicator--0b15efcf-fba4-403d-aa67-39affc92ccc8", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cedcf625-9951-4046-812a-977cb6dfffe7", "sighting_of_ref": "indicator--45081979-c7f5-4393-97d1-2432e9caec3f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--461d85de-5cf6-4bca-8d63-b007d0de91a3", "sighting_of_ref": "indicator--cc5f82e2-14e8-49ca-8989-d39218405ad6", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a65950d-219a-4409-b3f0-51f178ac51f7", "sighting_of_ref": "indicator--a4e83c7d-ceb9-4b02-8eac-046f78101f81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd223c18-5627-4e8a-9fb9-4804d628cc31", "sighting_of_ref": "indicator--a25168ef-5dcd-4ce2-b7a8-0111c9d63d08", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b363129c-d82a-4ab2-97ea-3816135822e1", "sighting_of_ref": "indicator--ebf12ae7-1d94-488d-a692-e5d2b62f1611", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667164f8-dc3c-4f48-becc-0d3466582281", "sighting_of_ref": "indicator--94938028-af14-4625-9e37-95729ad1a1ea", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3d56f1-8da7-4407-a447-708d8303badb", "sighting_of_ref": "indicator--a573e65a-2566-4e72-baf9-cb4b3759f013", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bf6af5c-454a-4624-8244-e6a6bfb92281", "sighting_of_ref": "indicator--8b31e226-3d84-4e4a-bdc6-797ce008b247", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16bae6af-9551-45e1-8aae-a4d9c0547dc8", "sighting_of_ref": "indicator--90a74f19-96ed-45c8-aa92-f70cecd3ded6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--affd6f0e-324a-477c-b016-c5ef02e6c47d", "sighting_of_ref": "indicator--7509be5f-e818-4065-9fe6-b381bf8586ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5a96842-c0b1-465e-8914-88f9cf7de82b", "sighting_of_ref": "indicator--91b7dd1c-8f71-4651-bca9-d141f787dd51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a38ac4-b27a-4646-89f4-60125cddf5f8", "sighting_of_ref": "indicator--4ab00000-5296-4efe-ae99-19cfaf626943", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c11e80f-f31e-407c-a40f-e5bf2d896f42", "sighting_of_ref": "indicator--55b70329-61fb-4f2b-abdd-3cc1be4d2547", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c2495b3-20c2-4993-8bc2-17d429b0e405", "sighting_of_ref": "indicator--e07e9a28-54a6-46e9-b9dd-bdb6ddc783f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b79fad0-b5f3-462f-a958-c5efe33a76bc", "sighting_of_ref": "indicator--941ba36b-42be-4c11-b9a6-d2900031b149", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e019ea4-5d42-4ef2-86fd-4ababe0a6571", "sighting_of_ref": "indicator--48fdced4-4485-4f47-bb6a-2cb7aa61035a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--937784f4-0361-40d3-b1bf-af59343c2c0e", "sighting_of_ref": "indicator--6e3c4e9e-27c0-4810-b740-fba81e4ade54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12797552-d020-433c-96cc-3190f0979825", "sighting_of_ref": "indicator--0d391f36-0ffa-482e-88db-1c0986678284", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6812a2cf-ebcd-43c6-8dcd-7d4dd7876516", "sighting_of_ref": "indicator--da8a9cae-4d14-4fff-9fc8-e097f474626c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20df2470-d112-4903-bcd5-d38c1de18d53", "sighting_of_ref": "indicator--9e488efa-36b3-48cf-94cb-36a41223cd4d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16c09ab-b2f8-44ea-9786-82662ee3d5cf", "sighting_of_ref": "indicator--168165c7-e716-409a-b008-a35e9372717b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516ae1d1-db54-41b4-af3c-ae52369b1776", "sighting_of_ref": "indicator--93c9037e-fe15-4606-8314-9e4bc9ebc5a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04987453-567d-402e-a9b4-34c081ebaeb6", "sighting_of_ref": "indicator--e38b5d7d-c5a8-4028-947c-5416fca980d5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b930642c-3efa-4c58-8542-1280e1ddd2e3", "sighting_of_ref": "indicator--873107aa-719c-4605-8405-4f979f08c2df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baac47e5-1525-439f-a46c-077f04be6557", "sighting_of_ref": "indicator--7fd0a8e0-6b1a-4072-80a5-f5fddbf4af54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3bf9b13-0473-4da4-a025-f95c1d342e63", "sighting_of_ref": "indicator--be15b0d2-8f69-41a6-a69a-aa7acf7417a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6542d980-dbd5-4f63-bb2c-f88d05547e84", "sighting_of_ref": "indicator--ab8f2132-b1df-4e5c-83a8-c98f5ce37b2a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c939376-56e6-4048-9123-18c6b208cbb6", "sighting_of_ref": "indicator--ab8f2132-b1df-4e5c-83a8-c98f5ce37b2a", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--841893d4-6abb-418a-b97f-9ebcaed48862", "sighting_of_ref": "indicator--c03010bd-1d4f-4bb4-a4f8-1b8345788c51", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee54aa6a-9c0b-4961-9c9d-4aa112811d95", "sighting_of_ref": "indicator--03ede66d-d152-4dec-9da3-e74ca572f807", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dad3ef38-438f-4907-aed5-cba70b43faf8", "sighting_of_ref": "indicator--93363fb5-0ed5-424a-ae05-278add4c055c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e3d25e8-68cd-4706-9b45-81767e006de3", "sighting_of_ref": "indicator--d33a86d8-12d9-482c-bcde-adff0c8b6cd3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdcba21a-874f-423d-885e-4dfcb9cc6914", "sighting_of_ref": "indicator--0151b8f1-997e-4242-946a-95052493aeec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38c57cfd-df5b-4159-8ae1-4660568f5b93", "sighting_of_ref": "indicator--485e81f4-261e-4cbd-9e9b-7202e7610fcf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--892a8c83-97fb-4f8a-aa2d-0f4f9ad17d02", "sighting_of_ref": "indicator--6322f361-865a-4e63-8e07-7947bee3aecf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a52069-89c5-4dd9-af62-1c039cac8771", "sighting_of_ref": "indicator--d251d224-a0fd-4a8f-866d-2fb7ffc59865", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defffeb9-1bcc-4ba6-a446-7cbf275ad4c3", "sighting_of_ref": "indicator--41bb9c7b-fd70-4edb-b670-133a552a2452", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3c49e3d-6393-47cd-8582-d9d6b189a6c0", "sighting_of_ref": "indicator--dcf03510-16d7-4278-91ab-db8d90e854f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39edf7d9-eff3-4236-aa2e-bb165f347b30", "sighting_of_ref": "indicator--2a9f055a-51a4-4ade-af9a-3677b59b4c19", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f90b74d-76a0-4de5-aed4-411e5113f13b", "sighting_of_ref": "indicator--7511dcd0-a245-43de-a934-848513443f37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bbfd0d0-2e1a-4c85-9fad-6197dfbbfab2", "sighting_of_ref": "indicator--c4e01074-97e2-4408-bc3b-3c670b35c8f3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c84debe4-ca7c-42be-adcb-02a68db72e04", "sighting_of_ref": "indicator--ce7fab1e-3dce-45a7-8b44-99c88e55f284", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f58c8eae-9eca-44c8-b227-c81aa18a624d", "sighting_of_ref": "indicator--5534af2b-82ee-48eb-8e4e-4a67842423bd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b3eb7ad-c3f5-45b8-a68c-e7542e5389db", "sighting_of_ref": "indicator--aeb45836-1251-465e-812d-91680f9ac502", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b334b71b-af7c-422b-a910-d1daad3c15ee", "sighting_of_ref": "indicator--137d3483-895b-4b26-9dba-c1e185166595", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d228a20-e6da-4726-989d-b456c845a4d3", "sighting_of_ref": "indicator--4c09f7c9-98a3-4865-a40e-6662d8d8857c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3141bbcd-ad8f-440c-8be8-b056d4c002ab", "sighting_of_ref": "indicator--de8eca1a-036b-4dbb-a6fe-e017f68396fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc881cff-f878-4091-b8b9-47b41f5877af", "sighting_of_ref": "indicator--a8fc101e-3eaa-45af-8aab-2991b9d35e73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1526a627-1af2-4b62-992c-4f3385bfdf6b", "sighting_of_ref": "indicator--7f5fbad9-6145-4926-bccb-da13a08d6763", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84fa149-e06b-4099-be47-c25161879ed7", "sighting_of_ref": "indicator--4c94b8a8-8fa2-43bb-b011-dce295f939ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cb91acb-2d53-4c74-ad46-11b54d5c5ac1", "sighting_of_ref": "indicator--8c00b3e0-2eb9-46b5-a59a-b2b47111e457", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3630ecd-3268-412e-8331-2b19658f209c", "sighting_of_ref": "indicator--673025b2-cc8b-4eb3-b0ce-e0d97bcf3166", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a7a649-1b43-4610-a0b8-76e548463d2d", "sighting_of_ref": "indicator--ae189a66-ec41-4ab8-9ffb-c9c79b5093f1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be3f0d24-a04a-4c68-b212-51b6e3abf335", "sighting_of_ref": "indicator--57da38b2-4a6d-4f95-8922-8fcae027adee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec0c037-158a-4043-bf2e-9a9f076a91f9", "sighting_of_ref": "indicator--23c0d3ac-4560-4a72-a72a-e350834f8c5d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f386378-f94d-4fe9-aea4-e0018e536e8c", "sighting_of_ref": "indicator--aa3368ff-4b14-4bc6-9fb5-51131cba811c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6182cee7-d156-4051-9b30-b59651bf5df8", "sighting_of_ref": "indicator--0de30a71-357b-4ffc-98c7-84a150e2fe9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db9d66ea-364b-420b-9b7a-27ba4251031c", "sighting_of_ref": "indicator--8932ac3e-77c6-4f2a-9a45-afdac5bfd239", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0f9fe6c-cfbf-4827-98c8-93790d2eb888", "sighting_of_ref": "indicator--e5f9324f-e47b-44a0-810c-2715cd1696e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df8191d8-7275-4bfc-90d9-1d612cb8d32e", "sighting_of_ref": "indicator--31d2d5d2-dfa6-4bbb-9c64-ad752c89fb7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f60462-f724-45b2-8357-5ccc4e14a71f", "sighting_of_ref": "indicator--bacf0fdf-1d56-4085-9234-047ba650d388", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c859aa5-d0aa-4a77-a5f4-64077a4dcebb", "sighting_of_ref": "indicator--e6792ff3-e68e-413c-90ca-6f561bfed6ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e936b01d-2af8-48bd-bfd2-2db9b513c92e", "sighting_of_ref": "indicator--d905a6e4-fb0e-491c-a525-e2fb98b9e7d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e6a25b-40d9-44ad-be0c-336b41586b59", "sighting_of_ref": "indicator--dc5b3448-0a5c-4818-aa12-9128bf2a77a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a463ffea-b846-490d-8530-360405579cdf", "sighting_of_ref": "indicator--d2e33a7c-31f4-48af-85fa-204609140895", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e707444d-7643-44bc-9809-129e189a7f06", "sighting_of_ref": "indicator--4db916da-b36e-4f37-ae14-d8b446b120be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b1933e-65c7-4df4-9ff6-3d095af08b6e", "sighting_of_ref": "indicator--168eaf06-391f-4194-9f01-9d3cff6fb5d6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6b9c3de1-a573-4a53-8835-ddb846fa0b71", "sighting_of_ref": "indicator--34e83b9e-83f2-434c-b24c-6e82ccaa47a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d120704e-1832-4c4e-be5e-d83f69b4519e", "sighting_of_ref": "indicator--96b1718a-22ab-4939-a3a7-698d075cefdf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--326c6822-1142-4de9-93c3-fdc5cb6ba93a", "sighting_of_ref": "indicator--719e0647-2f67-4ae0-a73a-6ad49df77216", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fbd1cad-e449-4180-a524-e94d4de09154", "sighting_of_ref": "indicator--ec96a072-3e6c-4c90-b09a-0210e1357552", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3f5aaed-741a-4131-a50f-5a0b93ddfe23", "sighting_of_ref": "indicator--cdf36277-0217-42ed-8db3-52d1f6498c10", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b1bd5bc-39a9-4ffa-9271-5827434ad552", "sighting_of_ref": "indicator--d0b69f86-cde9-4efb-af28-b4dda7474128", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d363596d-1763-410c-8553-931d09b22cfb", "sighting_of_ref": "indicator--4aa356a8-e408-4329-96e5-d647f58b7115", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c38cc20-3cee-4ee8-9b4e-975d3eb3b650", "sighting_of_ref": "indicator--4632dc06-e1c7-4f61-abf6-4c6f975f33e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--724223c7-ecce-4054-a85d-c0bc20bffdfc", "sighting_of_ref": "indicator--060fc67f-5095-4aa2-88d7-af89c368e313", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--807aa61d-3686-4d8d-b8ce-a2ad951409e5", "sighting_of_ref": "indicator--93dd9e0e-0642-4488-a42d-b95b171a8f64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c5e80eb-d4d2-4847-a29e-90988b61655e", "sighting_of_ref": "indicator--a19b0b84-639a-49be-8932-7fbac5aa550e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a023fe-f17b-4be6-9d7c-affe7d08d0cf", "sighting_of_ref": "indicator--4eb48c83-4c43-4119-ae33-76bd10281199", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11a9b52a-edca-407c-80a2-1f9e7aefa69d", "sighting_of_ref": "indicator--5a3c2c54-6e7f-4238-9047-5f079a246fa4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0592203-1bd0-473b-a381-deab5871c5b5", "sighting_of_ref": "indicator--33868f9a-9396-4ce0-87a6-8008c190cdca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64dd2d63-73b3-4cee-82d9-6fd1841a2b76", "sighting_of_ref": "indicator--4c3813d2-a5ae-4e56-8f92-108d10558745", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--434581da-8e02-4a39-a77e-ff64a9e44689", "sighting_of_ref": "indicator--95cccb17-c06d-497d-867e-53872875dbd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec644aa1-7434-4f02-b63f-cfd2727f3a55", "sighting_of_ref": "indicator--df6f3f6d-bf43-4a49-9aea-e5fb5d72774c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6bcfe7-ae22-469d-8cbc-f9980a55e412", "sighting_of_ref": "indicator--8f6771a9-7358-4638-b53a-03cb365c72f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fc6f0f3-00c2-41b3-8c77-2213efb71999", "sighting_of_ref": "indicator--c88f642b-5d64-429f-a4cc-ee0a92c9f2a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--916a1a22-ac0b-468a-bbd6-c07dd592b1d8", "sighting_of_ref": "indicator--09609114-b1c6-488c-9cf2-98b800ad0ac3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd09afb7-0ed1-46dc-ba50-9026d2b70b07", "sighting_of_ref": "indicator--64775ee4-7169-4639-a870-239aa93b467d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fb300b4-5c22-454d-9449-6e2ba2083fbc", "sighting_of_ref": "indicator--81efcd26-e819-4f35-b22a-df1789d0a975", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e1a5db-fe33-48d6-980d-9a0490ee432c", "sighting_of_ref": "indicator--d2774c64-2f96-432e-b961-14a90896a86a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4c9b71a-01fb-4fd6-a19e-9ebdcd0c77e4", "sighting_of_ref": "indicator--d2c29f5d-ff1e-43c4-97ad-c377f4c430b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95991ea1-5fe0-4d46-8268-5557c92e1d65", "sighting_of_ref": "indicator--f789605d-269d-4c4d-b6f8-7ba82aa88420", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1209e3ee-9294-4e2c-a790-d5235dd54e8d", "sighting_of_ref": "indicator--d53f3130-a2ed-4377-92ce-94ba208ea678", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10e3818-f90c-4566-a20c-f34c6a59fffc", "sighting_of_ref": "indicator--74517879-5f02-4f06-9e56-5584a8775b28", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9be62ee-0275-49f0-b11a-af224bd48920", "sighting_of_ref": "indicator--8a798edc-11be-4a51-a1e9-63c4ffd4f251", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92da45d9-8534-41d9-93b3-4e67f0227ce1", "sighting_of_ref": "indicator--de27111e-1f73-4034-ab9f-a22558af7647", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75763178-6139-407d-8373-4b98586070fc", "sighting_of_ref": "indicator--f1309423-a3af-4dcb-9022-dc9627c3d999", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f42ba4e3-4a4a-4785-b0e7-df1e4db2a321", "sighting_of_ref": "indicator--0ee18af4-9493-4de0-ac0b-3c9752660199", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d7a0498-7cc3-4465-bc68-ed6d656487a3", "sighting_of_ref": "indicator--c5293a9e-8590-4929-a80e-3ba56cd320ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86f043f1-ff4e-44c5-b737-4117f7286446", "sighting_of_ref": "indicator--63f25ceb-6b52-4902-a0e8-77faeb31e6c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a14eb2f6-601d-4763-8244-dfd6ac609133", "sighting_of_ref": "indicator--714d30d1-8aa9-4215-98dc-3afd6d5ac149", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6db66a07-5465-4e18-9ed4-cf9cdfb199fb", "sighting_of_ref": "indicator--362cdcab-376e-476d-9b19-a8aa25c7e877", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fffb371d-6267-4f68-b2a5-6b799029e889", "sighting_of_ref": "indicator--941f91fd-bc2a-4b81-bd72-2a57271bdb13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--045eb19e-6c2b-4889-8f56-d6b8a8ae76f8", "sighting_of_ref": "indicator--af7da80a-4ab0-42bc-a4bf-11555e42a70d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--871c8ae3-abfa-4a5b-96b2-6cfa3c2720e8", "sighting_of_ref": "indicator--11596ae1-803b-4a99-b694-477afe189a04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--727ed713-7114-4d37-9482-861ce59d99a8", "sighting_of_ref": "indicator--e23c5011-1cc4-48ad-b817-91749b38dcf4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f97b6652-3e32-4a3f-b91d-f9a55e6002ca", "sighting_of_ref": "indicator--3866d406-b92c-4468-b15a-232bb1a3a627", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4286fe13-8b4a-4161-bb30-a238e19da91e", "sighting_of_ref": "indicator--4df37f5d-7ca3-4110-8252-139bf8215352", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--550b10ae-5a00-4031-8f9f-bebb3ed3abbe", "sighting_of_ref": "indicator--5ef98a6c-4910-47a1-a4fa-523aa0c23133", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b36e81e2-af12-4019-9ead-3ebdaf69d23e", "sighting_of_ref": "indicator--c59a15aa-8e76-4253-81c4-e922aef3a018", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f049c11-676a-4bb3-b5ed-4b111eb58f32", "sighting_of_ref": "indicator--98bedd1f-8465-4339-85cd-ad4d94e81ef2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84bc0eac-0fa5-43ad-9d49-e77a7204c934", "sighting_of_ref": "indicator--4ff926ba-6726-4145-8aef-10710c0748da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8c23c6-87ab-4196-a649-75bf0b0d2ded", "sighting_of_ref": "indicator--cb5314bb-4484-4714-9ed2-8143334dde06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c520ac14-50c9-4557-afc7-374f888a95da", "sighting_of_ref": "indicator--1e0a3ab1-26c5-4324-bca5-d918369fce39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c03b669b-b46e-4dc7-a074-bcbb717a17a5", "sighting_of_ref": "indicator--c70a38e9-5590-4c02-8972-4acbc1005e9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eb2063a-28ed-4f89-8424-066155826e89", "sighting_of_ref": "indicator--4fa27742-564e-4d03-aa59-80be671ace44", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513f6a93-1225-4795-83e7-14a56c4ffa1a", "sighting_of_ref": "indicator--c05932c0-7b38-47e5-b8c7-9cb92b3dad04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9f3a3e5-90a5-47a1-bc34-1fd66eca677f", "sighting_of_ref": "indicator--437cf1de-0dc0-4c06-82e5-338f8250515a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e439e3bd-d1e6-4d2e-900e-4a416f055f26", "sighting_of_ref": "indicator--2af50c34-db01-49ae-946e-0d5b8e5caf96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f91c42d-7ea8-4ff7-b8c1-bfb19c83b9ae", "sighting_of_ref": "indicator--324d4767-dee7-484c-a7fd-ca0daf351a43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db49c261-6dd8-4fef-a9c7-6ebc26979817", "sighting_of_ref": "indicator--71b59c2c-3050-4e69-aeaf-a2ccd0c16196", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7df87888-7c01-419c-8978-1b35393e5f62", "sighting_of_ref": "indicator--240589d5-fb28-4993-9574-3d51eb0bce64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9143eddd-6df0-4a05-85b7-cec514e91bcc", "sighting_of_ref": "indicator--984244da-2a24-4afe-af11-539fa00a92f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25a078c3-cbe2-4714-b93e-7374ca2f6ebd", "sighting_of_ref": "indicator--6dd48a5b-39ed-432c-835e-98c0f13e71e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6707859-379a-4f45-ac5f-7f558def4adb", "sighting_of_ref": "indicator--af829fa2-2dd7-4cf4-aec6-1951437bc593", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--642f8001-0b94-4c7c-9e37-1fab303e0864", "sighting_of_ref": "indicator--c3bcb5ff-66c1-4b91-ae4b-c96040612b81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d77107a1-56ce-48af-8323-12bf6283cbd8", "sighting_of_ref": "indicator--e9d664ed-78c3-44f3-ac24-1692fb3f24aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0c14861-6993-4f83-92b3-4c2c5bc69a84", "sighting_of_ref": "indicator--bd7a2dfb-a1a9-4a17-9a1d-7ae0b726986d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80cde865-1438-4767-af91-ca8cb9ef3695", "sighting_of_ref": "indicator--a224c280-6a92-4103-87d4-bbf612fcfc3c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28256bd7-ba01-48e0-b3a9-5b6db6203be9", "sighting_of_ref": "indicator--41ffde3f-ee00-494e-a724-89c874701d55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa0ca91-bb3d-4d3a-ae68-83885b85d34d", "sighting_of_ref": "indicator--768c9eb4-cc79-43eb-8237-a40646d55ff5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2104cc4-e505-441d-a32e-b2cc063a4066", "sighting_of_ref": "indicator--8559f7a9-b82b-4fef-8ba5-aa2956fb70a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75675170-4d7b-403e-8067-3118e032f531", "sighting_of_ref": "indicator--ff0e5887-cb8c-4c81-9a58-6993c0fda54e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8652518-44d2-4a84-9fc8-f9ef96e66519", "sighting_of_ref": "indicator--c6d4af34-c30f-41c8-871c-e0f090f3bd08", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26875bb0-7d77-48e4-9a35-21bf58301938", "sighting_of_ref": "indicator--ebfac1f7-48f1-4dd4-8e4c-4254c933ba6e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cc895dc-c720-4989-8d98-c8f015a04953", "sighting_of_ref": "indicator--6b24223c-aa6d-4d00-bfd3-408f6ce616f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d390766e-2fd7-4033-8da0-67e87c50f999", "sighting_of_ref": "indicator--02940cdb-3153-46eb-a008-8fe11a34d9d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05e4c2dc-a5c0-4d7e-ae1d-cb37fa14cfdb", "sighting_of_ref": "indicator--4501f711-ae64-49ec-8e73-960665d1b831", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2764df32-2f7d-46fb-90b0-ec20afd11b45", "sighting_of_ref": "indicator--42e22494-77ed-4fc4-934d-4599e42cf7b4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddadcfa2-0eba-427b-a88e-cd4bdd235b44", "sighting_of_ref": "indicator--7b7142a1-7b41-40a7-8a1e-ed342bb227e8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04b22dc2-96b0-4d15-a37e-7433361c8beb", "sighting_of_ref": "indicator--6673d396-7b26-4f1a-b223-e3710a6a9cf7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa5c06b5-6320-47ee-ab46-295b2560270c", "sighting_of_ref": "indicator--6fcc400a-c786-49cb-b4f0-5e88d6ac6afb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bd3859b-e3c0-49ce-8e90-e3ad09b57848", "sighting_of_ref": "indicator--d4b7a084-937a-4fc7-a3b7-d8d849333cf0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f70dbb6-908d-4cd6-a3c6-a44f739ca538", "sighting_of_ref": "indicator--bf4da0ab-1ea6-487a-9f5b-de9fcb39014e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70df4414-a908-432a-b5fc-e4882f2ce8e8", "sighting_of_ref": "indicator--a47192d8-0bbf-4a3b-a940-1be79d155d96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c258ff9-d388-4dcf-8b9e-03450f3ce238", "sighting_of_ref": "indicator--a79c3c31-fe8e-47b6-9614-436a6beef6f6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ca31ea1-199f-45a2-ba30-9096a3af2220", "sighting_of_ref": "indicator--cdb69c70-ab23-47d2-ab76-caeba7cc63f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8169796-4894-4048-8966-ed197e1def20", "sighting_of_ref": "indicator--5eef9714-7dea-4097-9c4b-6bd218a15e92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62ded974-06f5-4a17-94dc-73eaee7f9647", "sighting_of_ref": "indicator--686974ea-9d70-4bce-ba6f-59a0fefc10bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ec90f08-5555-46af-8aa9-3d13698c3205", "sighting_of_ref": "indicator--25242761-7df8-4d4c-8460-82734aef6079", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--09f3b635-46fd-4622-a62c-988884ef48e9", "sighting_of_ref": "indicator--58696bb8-bc90-47bd-bfe1-4fda0bf403b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68dedd69-6113-4f73-87aa-539f9a647a9a", "sighting_of_ref": "indicator--6ffdcd58-e8cb-40ce-b4ac-f2ba6e869c97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--869c3ad5-50ba-4337-8d52-44b78fbe66d4", "sighting_of_ref": "indicator--1084552a-0bd7-40d3-8198-a36136d503d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7054d826-6e84-4d74-a130-853cd7ecd83b", "sighting_of_ref": "indicator--6cf7753f-090d-4152-b471-a212734d59ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7960251-d8fe-49c0-8df5-4e8cf4ec4eb1", "sighting_of_ref": "indicator--fda10eba-86af-44cc-9ddb-210c02f85481", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--194b2c6d-93e0-4a66-b75f-60ea5310e8a8", "sighting_of_ref": "indicator--c4ddeeb6-8d7c-41d6-bb4d-b9b5151a4978", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--204c52a5-d68e-47b9-983d-8ebc4cf3259a", "sighting_of_ref": "indicator--b89a3725-1580-4ace-aa00-857311258b3b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d63cb9-751b-4326-a915-486269deca67", "sighting_of_ref": "indicator--23496427-ba7a-4341-a0cf-109071279e27", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d3bcf8-c1d0-4b7d-a0e1-1a55ca48ee5a", "sighting_of_ref": "indicator--0300c8e2-2ab4-4e62-af31-bae819580686", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8132d498-5e16-4a4b-8282-d5872dd16c5b", "sighting_of_ref": "indicator--eb9272fe-5741-4ad1-9bc2-d630e7fd2159", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90e6ecf-1f8f-4ef5-b72c-ae32935162e3", "sighting_of_ref": "indicator--f4383d8e-6ebc-4432-af22-8179585e9e52", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e470d24-489e-4c5a-b573-fcdacea33cfa", "sighting_of_ref": "indicator--3aef389c-ad45-403f-ac34-982307876400", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d51eca2f-5c9b-4a83-a516-8916052b5fd7", "sighting_of_ref": "indicator--2d763ea6-98e9-4657-8211-bd000e7dd69e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d8cc166-12bf-44e8-8e6c-ca93fb4573ed", "sighting_of_ref": "indicator--127c0989-58c2-401f-8c45-42ac0165ee40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47c959ad-3587-460b-89d9-f1f50c522d6c", "sighting_of_ref": "indicator--697982b6-bcb0-42c2-8dc4-395183633a6f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a88252b3-2cbc-4fa4-abe1-256f6655c4b8", "sighting_of_ref": "indicator--d0a11585-df32-4e44-b0bd-9db9afcef15e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--729d9103-9317-44b2-94fe-9f12e2361d8f", "sighting_of_ref": "indicator--0c7f5c8d-a412-43f0-9507-6e3a478f8825", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c868a15c-27a3-45cc-a931-191a422ca07b", "sighting_of_ref": "indicator--b68f57f4-6d88-4ada-8934-b262f0a8b337", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2ab5461-1044-4deb-b937-d07804a878f7", "sighting_of_ref": "indicator--6ab097db-5fec-4f9b-9b30-6d9e72e2c383", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536a6059-4c32-4a29-a16a-8f1f576d2ce8", "sighting_of_ref": "indicator--17a41b3d-e97a-40ef-834c-f992f377cb43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--437b6904-5df4-4192-a37b-ad173df80a76", "sighting_of_ref": "indicator--e9de77d6-80ac-4676-a728-b968da69d377", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7253bdf-0638-48a9-af8a-da53f187d61d", "sighting_of_ref": "indicator--3d41092b-f6ba-40d5-887f-8263583b547d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14183cf5-557a-4f7a-8a03-dcaf52e809b6", "sighting_of_ref": "indicator--0ddc179e-1b55-429b-8b10-088b7e960afa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd665f91-1ca6-4a24-ab64-24c1ff92c98a", "sighting_of_ref": "indicator--fb1d3cf3-ce43-4422-a33f-f736d9c204b1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9995207d-2b2e-4dc9-bffe-d41b9271138c", "sighting_of_ref": "indicator--b9104e90-b221-4909-b978-61e9482df799", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1b0ec65-a47e-42be-a0a9-ffb945eb6817", "sighting_of_ref": "indicator--ae8a23ce-68fb-406a-a1fa-7ac1d44530c4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd7adfba-d311-43e2-ab06-d1163516d107", "sighting_of_ref": "indicator--96666bd6-67d8-453f-adc7-807492d747c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de1f6199-d361-4edd-bcb3-c0ffa97b8c2c", "sighting_of_ref": "indicator--6fce3de3-a347-4f02-9980-3a6d7a549a3d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d608bac9-7e85-43c5-96bb-85d79f6398ba", "sighting_of_ref": "indicator--0ea420fc-e623-413c-8d49-7a84b7cdc446", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--452913f0-ba79-4b02-b11f-d7a794c5e3a8", "sighting_of_ref": "indicator--e17422f5-7850-4046-a0d0-e11f7cd660ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ed0267b-7a94-4eeb-bb39-8fbf9697cd9d", "sighting_of_ref": "indicator--423d183a-6be2-48e2-9c66-9bea6b5dd79a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f373bf5-6732-4d1e-9602-ccb953e643c4", "sighting_of_ref": "indicator--285740a4-4b04-45f5-922f-7a7fa3369814", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--659ec569-a5e6-4733-83ba-39ba5e346ea2", "sighting_of_ref": "indicator--60885598-1056-4f9c-b3af-f1ce5a738878", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c879a7c-ac81-4c5d-bffb-a40820eb675c", "sighting_of_ref": "indicator--4192fe8b-84de-46e2-a594-67e59522ff40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaf6f671-c55d-435d-8518-755351dc3cb7", "sighting_of_ref": "indicator--bd1a6d1e-4a49-475c-bd3a-4755542cb059", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--523d8897-15de-41b5-afc5-b9da8b74744b", "sighting_of_ref": "indicator--12f12d06-feed-4f0a-bf6e-950c419f54d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--936a2d12-dcf6-4832-8d39-e9c78ed2c8a5", "sighting_of_ref": "indicator--4b96b7a5-85e8-43ed-a002-1014c6c790ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb9912e4-75a2-4b8b-aac7-6b94b84daeac", "sighting_of_ref": "indicator--14fe951a-70de-429b-986b-2dbd5828a097", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc63c225-1fa2-482e-adc4-476b083ea5a3", "sighting_of_ref": "indicator--54d6a285-d5a1-48fc-bf7a-379c6b290f4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f74f079-c20c-4e19-93d1-4200b9e6df9e", "sighting_of_ref": "indicator--68498583-774e-47ad-9c78-03901de6cfaf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb1d06fe-5add-4cde-8672-04c0b36e44b2", "sighting_of_ref": "indicator--e07efdbc-afe7-4f54-8fb2-cd707bf1b02b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30ef9bf-5061-41be-aa01-0155c0d68059", "sighting_of_ref": "indicator--2521f5da-fe07-4d20-8b44-5961944b7435", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04a6821-a225-495d-ab38-015e71ea977b", "sighting_of_ref": "indicator--80792e05-f63b-4fb4-8f19-f2a7ccd11e02", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15e1b094-8622-427f-b985-bd97f7615bf4", "sighting_of_ref": "indicator--5d44511b-700a-4a0e-b9dc-9332d9036cce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--832e66ec-7949-4841-9723-3c0784c70e15", "sighting_of_ref": "indicator--c7817997-695d-411e-a529-39a5cc6b455a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947ca314-020a-414e-b779-e165d0a95193", "sighting_of_ref": "indicator--4c7d30df-fe2b-4070-9700-2e7393bdbf70", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--726ec7a4-ef06-4d73-974c-c43586b54033", "sighting_of_ref": "indicator--269a7986-3433-4ac2-9d00-4e0ee3238356", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd19bbc0-d841-486e-8c05-f5e93b4a364f", "sighting_of_ref": "indicator--c497a0ea-f7f1-4cac-b7be-905ceec76601", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1759c12-3769-4174-b5b0-0a479d023878", "sighting_of_ref": "indicator--73eb1bf3-069f-472d-b76f-bafb91d90bb2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23f12710-5232-459f-b4c4-57b11454737d", "sighting_of_ref": "indicator--1a67e011-51ed-4e6e-b4f7-2df47f182ae9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd517cd6-198f-4fef-87b4-bf635dae2216", "sighting_of_ref": "indicator--4a57b8c2-e85c-475c-b4fe-584f521ae6b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65dca6c2-e504-4631-a080-3a376300333d", "sighting_of_ref": "indicator--3fe2bbc6-fdb0-4e48-93a0-2e2fca73c388", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99711d3b-c473-45aa-bc1e-d26ac84c9cb2", "sighting_of_ref": "indicator--534d4340-1ae7-41e4-bfbc-9cb42d259402", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72bfd6fb-0ae2-4547-b37b-e2e02a3264d5", "sighting_of_ref": "indicator--6ad17152-2155-4f1e-8963-77011b835235", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--366ba337-f8f6-4811-90ae-ef73b2ac6b44", "sighting_of_ref": "indicator--ad2876aa-5faf-42bf-bff9-b555ac8dcd9a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa6e311-aa18-48f7-bcaa-6b875e131871", "sighting_of_ref": "indicator--6503b023-2b36-4aa0-87d4-2324b8d10626", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05c0990d-97a0-4cdc-a712-0f73f1fbb141", "sighting_of_ref": "indicator--357a8b68-189f-4e74-99ab-ff091ad7e60c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66b2aac0-5bb0-484b-9cd9-3b472b28ef64", "sighting_of_ref": "indicator--daaded79-38b0-4c65-a80b-375163585736", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a174a65d-e39b-46a2-bded-25899d7b54c9", "sighting_of_ref": "indicator--e565cc4a-6f92-4be2-b2ee-35ac956372f7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed7044d2-365b-4057-a7c2-afccf06ee784", "sighting_of_ref": "indicator--7d0e52cc-1bbd-4343-8aa9-357aeb810c30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96da9de-fcb1-4c8c-8e69-103183b69908", "sighting_of_ref": "indicator--93727b4b-200f-41ed-8c3d-73cf3af2a656", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e7743c-2348-45d0-b241-f47453ef8ae0", "sighting_of_ref": "indicator--0ba309fd-75cc-4b7f-a38e-81bf041ad349", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c8177aa-23c1-4355-a906-720490836215", "sighting_of_ref": "indicator--c9a1f5f0-0b85-4ea8-a878-04960525bb96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d90e482-2e3a-4d38-8bdf-39b1ab024e2e", "sighting_of_ref": "indicator--5cab985f-cdf6-47ec-9302-a54a2cf42520", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4815aba-3e14-43cd-9e9c-58c94d30d700", "sighting_of_ref": "indicator--28e484a1-d0f2-477d-b870-62351986d524", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e78c06a5-4d7b-425d-a550-6ac198d49e76", "sighting_of_ref": "indicator--70386d24-074a-4949-8a5d-1af8f82aa7f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56961bd0-51ad-4d59-8f9b-308ebf363f4d", "sighting_of_ref": "indicator--6d6d0a9c-5b58-46e6-89be-621e94220b23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9775cba8-f48d-49a8-a580-a3ea29d42fce", "sighting_of_ref": "indicator--6885e73d-39af-4f07-a94e-187619f1cbd3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b683516-f2d6-42e0-b63b-3e58c164bc17", "sighting_of_ref": "indicator--49864a4b-8026-49c8-b9ba-679abc439c81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27360479-e888-458a-8029-3c103177dbc8", "sighting_of_ref": "indicator--13c978b0-1c5c-432e-840c-5e34e8c605e0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--445a9a26-db14-4e31-9057-ce2b4d24e24d", "sighting_of_ref": "indicator--961a364b-2b17-4380-b0d4-6e710f72498f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47047bbd-e005-4432-ae69-6652863386cb", "sighting_of_ref": "indicator--4c6276e0-7252-4adf-b30b-9b03635e4516", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124f8ae6-14c8-45ae-bc82-6a6c1ed2bc05", "sighting_of_ref": "indicator--2d07799f-b068-43f9-8a13-037ef477d259", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0572d7eb-14b4-480f-8f0c-f1b9aa5dad60", "sighting_of_ref": "indicator--5b808f92-37f7-4f35-b686-117584b14524", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3332864-348f-4aa1-bfe9-be9a99e11c0a", "sighting_of_ref": "indicator--8b09d84b-3fea-42b9-b2e8-6d970a725f19", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--154676b2-95e0-4775-89f7-da8ed86c79d9", "sighting_of_ref": "indicator--87f03afc-bfec-4b5c-b69d-53a9fca61f43", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38aa607e-88a6-4c75-8cd1-32bcade319fa", "sighting_of_ref": "indicator--74edbdd2-d71b-41e0-b07a-fce2f941fa49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63746271-1a99-450a-8d97-cbd2924706a8", "sighting_of_ref": "indicator--231bec0e-e3c8-494a-ba67-b094d9439934", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb310ac-53d6-47f8-a631-568ed85d5a0b", "sighting_of_ref": "indicator--a54e2035-47fa-48eb-a3e2-3fa7ca98c976", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--821a24de-6e2f-424e-9c4b-63b1150f172a", "sighting_of_ref": "indicator--0923210a-7b94-4c79-b34d-8eae96f8b6a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff413623-7486-426b-9500-b73881c48819", "sighting_of_ref": "indicator--d6700af8-000b-40ab-a00d-515b473b20bc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54364540-998d-4d44-b0d8-cfb80ac647ee", "sighting_of_ref": "indicator--a15c77de-e979-4725-badb-0e9ef2e2d992", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c17cc4bd-f3b1-4295-83b8-528204e150b7", "sighting_of_ref": "indicator--77a668ae-aa8a-44f2-aacd-f0e9786eb5ec", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b895d943-b233-4c96-ae71-2ac621b6c9ab", "sighting_of_ref": "indicator--2e6d5f77-edb9-4a67-be48-84b6349aee0f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9034a2e0-929c-4590-ba4a-1cd01b052acd", "sighting_of_ref": "indicator--d49c2715-fdf3-44bb-8911-659383ec2541", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72ed35cf-216d-4cb1-b66d-ba78d8feaec9", "sighting_of_ref": "indicator--c685214f-8a26-46c4-903e-2a6f219eda11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd12480-6512-418f-82fd-dfdd116507fe", "sighting_of_ref": "indicator--aa920cf6-d512-49ee-a553-1d2c37656aa7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343bf208-aa5b-4c52-a403-0f1cc5efe638", "sighting_of_ref": "indicator--3a17bafc-d7bd-4950-a350-fc38972130a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fad80858-bc2d-4667-b368-73b5cf4f2e92", "sighting_of_ref": "indicator--33cf64a0-3c57-4617-bb1a-6a2287699c57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f09ecf97-ab75-41ea-add6-f1b58dd453de", "sighting_of_ref": "indicator--f4eac156-a7be-40b6-883e-5b06ec329bfd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d16a3ac9-5513-42f3-ac4d-fe81837dce62", "sighting_of_ref": "indicator--90b264d3-db5c-4665-8ed3-be0a010cd519", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12f92f5f-bee8-4ce7-bf02-f37a013a0d41", "sighting_of_ref": "indicator--ac148ac4-ea14-4f0f-a09c-12c934b30209", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae1efd2-c76f-4c75-b78d-29baa99c3637", "sighting_of_ref": "indicator--a0c1ad84-e0bb-4a7e-b94f-61513c33e1db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ab1e08-105c-4975-9bc0-682b79919877", "sighting_of_ref": "indicator--f3b647ad-9667-4a84-bab2-845fbdd9ebce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b582435e-0bdc-4e7a-a53b-b7e4585266f2", "sighting_of_ref": "indicator--b2254071-7d62-42a1-a456-70f0a87b5f64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e5bce10-849a-491d-a3e7-316e7ba66a57", "sighting_of_ref": "indicator--0d5cf4f4-bd57-4013-87cc-72521fa4e73b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa255d16-3929-4026-9ad6-337626e4c460", "sighting_of_ref": "indicator--28077a75-16e9-4605-bb1e-009fae6a63c7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97e79bb0-0d9b-4121-8271-418686e343d3", "sighting_of_ref": "indicator--0811b1fe-3bab-4bf3-a463-6da6226c8319", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ab13440-7db0-413c-a773-e50110c14436", "sighting_of_ref": "indicator--10e8ac2b-59db-46ec-a5ea-90a3cf7a4b58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970c7a10-634a-4327-b0d7-feed70be8888", "sighting_of_ref": "indicator--a7413426-e71b-4083-88e0-96f74e96cdef", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3f6856-7507-4d44-91cb-79806595d2de", "sighting_of_ref": "indicator--9d827f1d-8155-4966-8c77-59d9abcd0f64", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cda66b49-a845-41a2-9e91-5f8076dc16d4", "sighting_of_ref": "indicator--b4fab8a6-4563-4bdb-82ba-d9e6ee7fb358", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b8b5bd1-cba3-4985-a9d4-8353d3163e02", "sighting_of_ref": "indicator--6bb72af8-0b88-4e45-bd36-86d7dbab92fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddbc2bc7-6ec1-494b-9752-b9f2caf87b40", "sighting_of_ref": "indicator--155ba809-e9e5-4b60-88e5-bb2216c7eba9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b474551f-1bda-4970-bf11-c5f0673a450b", "sighting_of_ref": "indicator--0e69840e-62f7-4cce-bfca-21fdb075454c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ccd779-20c8-4827-bece-063def565fa5", "sighting_of_ref": "indicator--b93aa1c5-bcd2-4730-a8af-f7b4ae1cc193", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355978e0-44b6-4a86-bce4-b6bf12d10c6b", "sighting_of_ref": "indicator--c68660bf-95f8-4d12-8901-222d6ddcc9c5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--998f3e02-1502-49e0-8d7f-5c4e223807bb", "sighting_of_ref": "indicator--437896e2-79d5-479a-8a54-3eca7f0cb649", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f0b5e72-3120-4934-9d5a-c159ea52d556", "sighting_of_ref": "indicator--fb377532-ad40-4343-9e26-b83807c66edb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6084fc07-c681-46ae-a134-667ca7f9b9e7", "sighting_of_ref": "indicator--1b3e844a-20c2-4c81-87fc-0a3bf7a158c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4acfabbc-d9b8-4e12-941d-0f7bb4eac751", "sighting_of_ref": "indicator--bc6706ce-92a5-4ba6-89d1-e28a266f30d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--967f3d00-9ccf-4d81-8a26-3eb65c78d363", "sighting_of_ref": "indicator--a9a74d77-8a0c-4cb2-b513-8c507262cc73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--637f8246-fd85-488c-b129-6185beb1fa79", "sighting_of_ref": "indicator--a9a74d77-8a0c-4cb2-b513-8c507262cc73", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ed3d095-dc56-4582-a5d2-c2c716e63f40", "sighting_of_ref": "indicator--29381691-7106-4077-940c-f8d9197cbb33", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d52d654e-21a6-4cda-ac73-905bcbab6168", "sighting_of_ref": "indicator--a0a548a3-2b72-40e7-b94c-8d0c2f9b4d17", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32642cbd-6cbe-4612-96c0-d1b156304b78", "sighting_of_ref": "indicator--9b16f14c-14fc-4c37-8c1c-d4cd11ea3325", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a9bdf57-7ec8-4c27-9538-97a40866af41", "sighting_of_ref": "indicator--136c7270-2211-4fc5-bb46-dc0359bb8418", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e39cd86-467a-4adb-9d8d-0c3f96bb3b60", "sighting_of_ref": "indicator--e3058c12-c9ab-4de5-ad84-c3ef776f38fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d0dbf0f-bef9-4361-a957-71629eebed66", "sighting_of_ref": "indicator--2f7eb857-1da1-4e2e-80aa-0f5ae1f92357", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eef0fb9-87f6-423e-aa3d-0a1988619e3e", "sighting_of_ref": "indicator--d6f9d8cd-1155-4640-bd88-b79c032500e9", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5762a73f-87bd-45fd-941a-091724a4666f", "sighting_of_ref": "indicator--fcca25b8-6c00-4b05-89cf-ebf2bc5fda6b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ed3763-c437-447d-af62-bbda63ed56c4", "sighting_of_ref": "indicator--51e583d1-14ca-43ad-b165-0daabf0b040a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75083f7b-900c-41d5-9a90-f7ec3bbc4774", "sighting_of_ref": "indicator--dcea0eb7-6cd9-4c57-be4b-34df9adf4145", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c71c4c99-4127-4d83-934d-7340587e1df6", "sighting_of_ref": "indicator--8e8425f7-b76e-454b-ac7c-79d90f6b041e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2102489-d7a9-424f-821a-a9078ba416ff", "sighting_of_ref": "indicator--d2b67d13-7bad-4503-89fb-606f4bc78af6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67602232-b2f3-4a7d-b14c-c5e232bbea90", "sighting_of_ref": "indicator--1070b26c-e5f2-438f-8dd3-6e056fada5a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c60e80f-56aa-4524-952d-03d0929952c1", "sighting_of_ref": "indicator--e04acbb1-e96c-4ebb-8d0e-77a85ec76f79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cae98c76-d8ec-4ebf-a2cb-b97042fdc4b6", "sighting_of_ref": "indicator--d9fd7a1b-a3bf-4fd4-a5b0-a26f96f98404", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d6de969-0724-4e0d-b41c-9886ce0a84c7", "sighting_of_ref": "indicator--b28a05c4-01e7-4fc4-8c13-2127cbbf7cdb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458205b5-64ac-442c-bf28-d78d821a86c0", "sighting_of_ref": "indicator--8a5133e9-63ef-4e76-aca0-8dabb69b3271", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10ac3ed1-8fae-48b0-9a4a-9bb71acf2908", "sighting_of_ref": "indicator--95d4a36a-736b-40e2-82b3-e7e679da4772", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6aef9643-5516-4211-be5b-c5b67c66a447", "sighting_of_ref": "indicator--87bd88bd-26fe-4f19-bcfc-3e624e6999fd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c199e6c-3252-4277-a137-f608ec6a0d6a", "sighting_of_ref": "indicator--50fb65e2-c3aa-4275-8420-29e59d86cc25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320369ad-0bf2-4590-9d42-908047e36868", "sighting_of_ref": "indicator--58eeea9a-e024-4f08-bbe5-706465b9758c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe4d68e-6a37-4d3f-8bb0-34f5cf4d9e92", "sighting_of_ref": "indicator--e3ff854f-d1cf-430a-b397-a1df4130e0a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bad1f093-2f75-439a-987d-6ae74f1ec5fc", "sighting_of_ref": "indicator--1f1a8962-ac04-4758-afbf-b063cebf9091", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84a5d230-d38d-46c4-a737-ab43c36d4570", "sighting_of_ref": "indicator--3cd465f6-4238-40b5-b894-97b16337b27d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--182c979a-6234-4922-b554-43159261aae1", "sighting_of_ref": "indicator--b0916688-5245-44a8-8456-906726c0a78a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ebcdc0-0f13-45b4-b3b6-bad3d6601284", "sighting_of_ref": "indicator--9dda878a-3864-4f90-98d4-3ea81b596713", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e40d09e4-9360-42bc-b693-5283769d5f2b", "sighting_of_ref": "indicator--3c73a984-e49c-405e-8bc2-06fc0c1de8e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17337558-33a1-4f4f-a7c5-6befbb328e40", "sighting_of_ref": "indicator--0b72f181-13f9-4c46-9487-c8434d6ff92f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0758c2ca-88df-4229-b992-42fc93fa461b", "sighting_of_ref": "indicator--c1288330-9cb2-4d14-8272-212bb3c5cd06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a581415-9802-45af-b377-a6771e3b2cdc", "sighting_of_ref": "indicator--a27ad36c-5afc-4690-ab13-379296c1cd85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b17f0fb4-66cd-4e98-9f2e-85e399c359cd", "sighting_of_ref": "indicator--1ca7c67a-7742-42c3-b9ad-42f0fae84857", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0240b792-0eb4-4457-8505-999ac8b9abd0", "sighting_of_ref": "indicator--e5646965-e5da-4aa0-8748-cf22350644e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89e84654-2218-4dbf-b983-1f672a10f86a", "sighting_of_ref": "indicator--6e0c9077-e503-41ca-8fde-ae0112b757af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ec2f2c4-c7f8-4fd3-a736-d0d9244154a6", "sighting_of_ref": "indicator--6e0c9077-e503-41ca-8fde-ae0112b757af", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a525491-b2b6-4bec-8dc0-5f2caa36627e", "sighting_of_ref": "indicator--e51363a5-4e42-4861-a72e-d6e14b32a91a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a3b9786-52c1-4a18-8783-3eafefdbd137", "sighting_of_ref": "indicator--a6a22cde-aa6a-4d86-806a-151f730ca0d2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8574c2a8-3802-4b04-8a6b-367135615eb1", "sighting_of_ref": "indicator--c5e23ea5-9e5d-4ef1-9f59-1504e418a31d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2faebbb4-481c-432f-ac34-358e5fc80b46", "sighting_of_ref": "indicator--3b62c722-5fc9-40f2-9b1e-73f1abfe8529", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02bdf2f4-2539-4713-adee-9cc45bcbc556", "sighting_of_ref": "indicator--d861cff9-7174-40e6-be22-7093545ae281", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d8f78c-0ec3-46d9-bfec-28f1c258dd3d", "sighting_of_ref": "indicator--5c2b1584-b0aa-492e-8d6d-2fd8b6e12dff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03f1adb0-1b6e-40b5-a055-d8cedeb499d4", "sighting_of_ref": "indicator--b4bca4ec-c28f-42dc-a466-e48e0115c231", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31bf2a55-9b2b-4604-8853-156c4a9c791b", "sighting_of_ref": "indicator--c132b9e1-40d6-4c4e-b6ac-91467af97460", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8c1f9eb-9531-4c5e-aa3f-32a21b3be036", "sighting_of_ref": "indicator--901b0dd1-730f-4a67-b618-566f56d7d984", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d423ed92-3503-447f-a221-ffe8997ace9b", "sighting_of_ref": "indicator--0dcdbf06-1359-4b0a-804c-c50ac3522e94", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189b8f0c-f5f0-4eed-b6ab-5277e64ff1e2", "sighting_of_ref": "indicator--cf83a35f-0a68-4974-8077-8893bb20924e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--553d88d9-011b-45e5-a7fd-08f50e3a4448", "sighting_of_ref": "indicator--4fe498f8-af74-418f-bda9-8f592d25b7fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c472885-e627-4360-a019-70f04a5aeded", "sighting_of_ref": "indicator--71ec6091-4741-4dac-87ee-d62e5bca928d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08974f05-b8f9-4308-996b-7dcc2d7e8f59", "sighting_of_ref": "indicator--2ae12fc6-79c8-41b7-b12f-8fa91c919c1c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8974223d-cede-49f9-8f17-f3890166f2b7", "sighting_of_ref": "indicator--c6b77e3f-329b-42e8-b993-e7fec2a25470", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ecdb7fa-9e07-46f5-b3c4-8170a1219d2f", "sighting_of_ref": "indicator--ea2e5fe0-6746-4b5a-86c6-6b08d013d0b3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bd2456b-5aa3-4188-939c-e0f085a70847", "sighting_of_ref": "indicator--707d7a4e-fb26-4b7e-b672-9b2150c41a43", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539e7a67-3e8b-4ad2-a5a5-047f8e0ff27a", "sighting_of_ref": "indicator--3bdd476f-5a8b-4620-bd58-37b574c838bd", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b174de35-4ff9-47f0-9ac3-82f077be3231", "sighting_of_ref": "indicator--f00a42d3-98a1-4873-8cd4-98732e602cf3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--682e6bc5-7333-4c16-99e3-fa39222a2f7d", "sighting_of_ref": "indicator--3d257473-dfba-4b2c-ab9d-44073e902bcf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de434119-978d-43d7-a0da-57419f410b09", "sighting_of_ref": "indicator--c8048546-b2ca-4106-9c7a-cfd47e00a16c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c37b08-76dc-4bf8-a639-9f17d2e3212c", "sighting_of_ref": "indicator--59723693-32bd-4241-83b7-6a9fa5f3673e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40dccbaf-d901-4834-bd7a-309cd757c76e", "sighting_of_ref": "indicator--907b83bf-fd66-4dac-aff1-44e773652221", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9463a53-d19a-4486-9b6e-ca5407ac2273", "sighting_of_ref": "indicator--ce2cad11-3d43-416a-a3f7-712ae3368b2d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51d1b5b-efaf-44c3-879e-653a1a941de2", "sighting_of_ref": "indicator--9d59be09-2a1f-4f10-84ad-8043d1553980", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d278cdc5-d4f3-4895-8eff-9b894fdfe540", "sighting_of_ref": "indicator--c7e9fb04-facc-4767-9ace-73b3885e4acf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52ed271-3be3-47a7-8ee3-1db93c3bbebd", "sighting_of_ref": "indicator--ec45e694-5917-4599-82a2-b8e48f61af83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6187f1f9-ddce-4cb7-90d7-c643f8185bca", "sighting_of_ref": "indicator--7b3fd3a7-43c0-43b8-8cb3-6bfb99f9603a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--edeacb55-f716-4fbd-97e6-5912cc49537d", "sighting_of_ref": "indicator--7196acb5-c9bd-402f-9e13-351659231aa1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d358ac2f-8d3f-4e0d-9b76-8a59c48e8fb9", "sighting_of_ref": "indicator--af14caa0-512c-40c9-a4a1-3b89e3d38ea2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f27f2a1b-3cca-4ed1-8ddd-b988abbfee78", "sighting_of_ref": "indicator--f9191ed9-2603-494d-bb16-f27a2f550d4a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb1c6825-18d0-4fba-a642-45a64ebebf71", "sighting_of_ref": "indicator--b6b5526c-78d2-47e7-904d-c8e1c7f332fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d2de35-94b6-4b66-a9af-eb23ef1742b1", "sighting_of_ref": "indicator--553bc1eb-8d11-4074-b70c-b7fd4a818c9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c24953d3-e3ea-4a54-891f-956ee470f17e", "sighting_of_ref": "indicator--5e615267-af6e-44b0-859f-0e892e26be6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27566b41-295c-4100-b37c-2ad9872c8f94", "sighting_of_ref": "indicator--7556cf23-6101-4fdf-8a38-1c868c5de67e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036d3dcc-50a8-4082-81a5-171b7a33a973", "sighting_of_ref": "indicator--162c0dbb-b308-4600-8954-e19d31752c0d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1bfca9e-3989-48c4-a19b-2e5efc581add", "sighting_of_ref": "indicator--4d8fb307-0dde-4a18-9e9b-4842c2fbd870", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f2d623-6de7-442f-a9ab-7801fe3adbf1", "sighting_of_ref": "indicator--ccaf3542-5afd-48a3-8b6c-2e578de4056a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37d3162e-65d1-49ac-8d25-ffb8210d16aa", "sighting_of_ref": "indicator--4f52227b-f4c6-4696-a2b7-794cd03afb38", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d4da7e-5066-4e61-b169-f460f6bea63f", "sighting_of_ref": "indicator--d4176fd8-76d8-47ef-913e-8aaa6d5bd1ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb0f7452-053c-446d-ab43-100b457bcf70", "sighting_of_ref": "indicator--9270996c-4e64-475a-9e5e-efe35efd5ce3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b62ee07-ee66-4ac8-a156-a7312060c6a2", "sighting_of_ref": "indicator--ffda1086-da84-4537-a21b-c62a9ac63cf2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75a3632b-4759-478c-8436-6ea58c353705", "sighting_of_ref": "indicator--e37cb975-5f7c-468e-9801-a6b280b24b15", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5e52a76-87ea-41ed-9e01-a5a53d203691", "sighting_of_ref": "indicator--9a9f4a27-8fdf-4a14-b83a-ecc43695bd06", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af3d5148-226a-4765-aaa1-a97e039dfc9c", "sighting_of_ref": "indicator--0fa2b0a7-8d25-4da1-b013-cffc5b6b89ab", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61dfecc-db47-4b3c-b216-6adf950aec7c", "sighting_of_ref": "indicator--f25f5a90-22e4-4bfb-9d03-51a5002eee00", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63f63ca0-42eb-4651-b1c3-9932cac65b13", "sighting_of_ref": "indicator--3b522554-b5cf-49e1-b36a-34cf8312fc53", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9bcd073d-262e-4a78-8a9a-75baeed2dae6", "sighting_of_ref": "indicator--68f2cebc-5153-40c9-ad97-31859e23a378", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa03704f-0d26-45df-a330-23c07aca0bdb", "sighting_of_ref": "indicator--32f319d3-cefe-4e2b-84ae-b09acaaea020", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d450a733-f309-4097-b96e-b875f6b4790d", "sighting_of_ref": "indicator--356be926-3fc7-4f7e-8c61-a8ea6a74e2af", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30a49e31-4b84-4330-9d58-adb6e61b5fc7", "sighting_of_ref": "indicator--40162892-9228-425b-bb8b-b6a614d74f47", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--769ecbc4-eaad-4d7d-9db4-aea30fad2738", "sighting_of_ref": "indicator--0700925b-e23b-4c7e-9e38-79d0a38a1832", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab538e6-6e1c-4320-92fc-21117bb027ce", "sighting_of_ref": "indicator--1d0eee5c-5c25-4a2f-aff9-d80ef8ea8a96", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7514560e-8c98-485a-b740-bf0306d52ccc", "sighting_of_ref": "indicator--278b653e-80b5-4d31-9e52-ad798bb1c9aa", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b07f82cb-0312-4a68-b5ba-9ba31b87ce9c", "sighting_of_ref": "indicator--1709c4dc-57d5-4c3f-bcfa-a03b02ce750a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf566230-61d6-4ea0-9a12-d131c99e0fbe", "sighting_of_ref": "indicator--eda1d388-7c12-4d7a-bb7c-f34a3d4a1e2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bc38032-a631-44d6-8277-654337d0b5a2", "sighting_of_ref": "indicator--8cf7a1d1-a043-4d0f-94a3-24a7b3118f8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f777e60-6e8d-4a06-80af-10b37d5634fc", "sighting_of_ref": "indicator--b8154220-58f0-451f-9774-30a1e6d5a23a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d64f92ae-0d9f-40bc-9efd-55b0fb39a5d5", "sighting_of_ref": "indicator--35abe7a0-6f2f-420c-9fa2-d43b4e359ba6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--331b4bd7-9a4a-4153-9808-62703458a9f4", "sighting_of_ref": "indicator--ca37e723-8ad5-4012-84dd-55401c60999b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64eac96b-02a6-4c08-978f-d6d69409ff9d", "sighting_of_ref": "indicator--4122a2d6-7ded-4d60-87d9-35465392749b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018bf7c1-432a-4c2d-a2f2-5d8c64f2f3a4", "sighting_of_ref": "indicator--c4403989-7de3-4518-b2cc-af5e4040e46a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0e05196-1d7f-4802-a06e-dd8864509090", "sighting_of_ref": "indicator--92fc3682-a70f-44ab-b497-d90961ccdfc4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bd0374b-2876-4b6d-a01e-7b0c5e57e091", "sighting_of_ref": "indicator--d9b6671e-b506-4bdb-b438-838c0749e393", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f213f71-0a87-4754-b3bd-51007d23a126", "sighting_of_ref": "indicator--f9815de0-fb1c-4bd3-bc86-a594c7667d8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5118483-5530-4a97-b8ab-b9e60e84008d", "sighting_of_ref": "indicator--df21fa24-66b8-4060-b49d-0dfab9258f25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9fbbf28-0232-4f3b-bff2-2f5b75fd6bf5", "sighting_of_ref": "indicator--f2e382c2-b48f-41b4-9618-b260e2c39e8f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59cd4ba3-80b4-458e-afa6-d23da530f432", "sighting_of_ref": "indicator--d38991b1-20f4-4e19-bfe4-85943db5b455", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82175aae-48ad-4ca4-892a-ff1ff0f02ea2", "sighting_of_ref": "indicator--5f70704b-7f5c-43d0-9eed-e94c4dc591d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d570457e-c44a-479d-8e41-983dcae8b4fe", "sighting_of_ref": "indicator--15eb5c0e-89ba-4aab-8e4c-72aa4e3d7d40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f79321a0-e159-428c-bb63-539457ca2546", "sighting_of_ref": "indicator--c55e80c8-3f3c-4792-995b-c38270a8aead", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13bebeff-db35-4ea0-886b-ffc33e587159", "sighting_of_ref": "indicator--bc848aa3-350e-4e15-9d39-c9a6de379b55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f506723-40e2-44ce-8130-53053b523b60", "sighting_of_ref": "indicator--46f33760-fdd3-4baf-9906-45af1f714714", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d7cd8ec-fe35-4b05-8358-16ef7f8027d2", "sighting_of_ref": "indicator--8b4e64a5-f1b9-4eff-aa6b-248368ef24a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a02ab7a7-04c1-4a44-af0e-ff65cbfe559d", "sighting_of_ref": "indicator--b2af320d-2dc2-4e13-ab9c-4728227c6b93", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8fa8c7e-d728-42ff-9752-b8191153db84", "sighting_of_ref": "indicator--7462a8c0-0746-48ad-a31f-35fc79d4824a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a34f795-c5d0-4567-9bde-70841fd902fb", "sighting_of_ref": "indicator--d899d266-ace9-4a66-abee-f9ee1054ba13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ada7b0c8-5d52-42ec-b57b-310de0238535", "sighting_of_ref": "indicator--9e9900f6-f6c4-4ec9-b676-788cd407d994", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13d16aa5-ecda-4aca-86c6-e9533fabb9f6", "sighting_of_ref": "indicator--e6809489-fc8d-4938-8417-3d0b82c11f0a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--262c25a7-60a9-40df-b782-653cb2c64017", "sighting_of_ref": "indicator--55fcfa09-61df-4d95-8868-ff48c49b42b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6e99fb7-4775-4911-9945-a829a10953af", "sighting_of_ref": "indicator--0649982d-31bc-4b89-bc7d-1af7dc94b5cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec11658c-fb29-4f78-9757-1c04df6d7165", "sighting_of_ref": "indicator--2e7051f5-916c-421b-891d-ddbd5aa0ff29", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8c27862-16e6-46ea-96b6-47f3c92519ea", "sighting_of_ref": "indicator--62529942-ddf7-465c-8cb3-b7df27b03c98", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40d034ae-9993-443a-82ac-971e3520f0c1", "sighting_of_ref": "indicator--e705fbd0-acc8-44f4-8c22-9c23ddc6beaa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e59c463f-e991-4c40-b30a-f7e9c7069c27", "sighting_of_ref": "indicator--eaec56cb-17dc-407f-afdc-b2e2a2f8c154", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2f24e96-c74a-4bb0-b900-cc58dbe645bd", "sighting_of_ref": "indicator--590b0cad-c5f5-4148-a698-84d37ad8888b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a20ff6-3e0c-4f36-b550-db2586697946", "sighting_of_ref": "indicator--9b47ef2b-aa98-42eb-821f-4735021449dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a0a45ba-80a4-4756-832e-77e2207b3615", "sighting_of_ref": "indicator--62339a0e-79c3-4a53-a8d5-8abcef859270", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--588d5edc-b504-4058-9abf-39933bcc65a9", "sighting_of_ref": "indicator--dc815f0d-c400-435a-b7bb-bf3ea031e3ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a92f8c-e6a5-48e3-bb11-ccd6fd9d25ff", "sighting_of_ref": "indicator--b50d2583-3632-4c05-860e-a04eff90ecf3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--284220b9-31d0-4b99-8f34-305c2b06489c", "sighting_of_ref": "indicator--067875d4-6706-401f-b606-623db527ae20", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e8ab531-226f-43f1-9076-d53bb1156d26", "sighting_of_ref": "indicator--e2110d13-4fb4-4376-b9fe-0d0c9cb64adb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d19d4e1f-eb5c-40a4-9d32-96f48914befc", "sighting_of_ref": "indicator--e2110d13-4fb4-4376-b9fe-0d0c9cb64adb", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c1b7f01-1816-411c-814f-2add4304f1f8", "sighting_of_ref": "indicator--d64afc55-104c-4c03-9f6f-cdc539a7cfba", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1cb48d-f6dc-4004-b040-e044151d97e2", "sighting_of_ref": "indicator--58a3196a-28ba-4ed2-8b36-00a7ebcee899", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7cbbeff-a48a-4d5f-853a-bcf202ac4af7", "sighting_of_ref": "indicator--c543ffed-0af0-4cdf-81d2-27a2352c9c56", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05cf5432-b764-4e31-a9d9-6b7cc1bac615", "sighting_of_ref": "indicator--eff15d3d-99df-4b4f-8aa3-680d3a939f7f", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--436a5731-2ede-4911-932f-9c081cfb8d3a", "sighting_of_ref": "indicator--72149076-4097-48fd-866d-1e7f510a834c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f00322e0-f59c-4fea-82c0-9b92648ea417", "sighting_of_ref": "indicator--a8f75e27-c859-46fb-891b-a8e413ca5641", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1dad3ae-fdcb-4fc8-bb76-43130b2524d4", "sighting_of_ref": "indicator--62d61797-18a8-4c87-93c6-244baaefc980", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--948907d4-62c4-497d-b9bb-d1dfcc4e0cb1", "sighting_of_ref": "indicator--299533da-f888-44f7-ab4b-4bb5cb9fa39e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4805c219-0814-495a-ac17-cdb1bc165def", "sighting_of_ref": "indicator--a3dd6915-9048-421a-8f12-eedd0486501a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3346c454-fdfd-409f-8ed7-9154d186bb0f", "sighting_of_ref": "indicator--28ca0c41-fd8c-4ccc-b772-b0ec23e9dd47", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9686886f-5004-4535-8cd5-484d4db6eba4", "sighting_of_ref": "indicator--6e62fe6b-442a-49ba-ba69-2a750feb24cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4ae0a67-42df-4d9b-8462-1876b31676f9", "sighting_of_ref": "indicator--ca098cb3-8a2e-4a6e-aa77-ad0014a7572a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b06a6f2a-4b0d-45dd-a8e6-fd5bbc8258d8", "sighting_of_ref": "indicator--555bff97-95a1-4f12-92b4-58d170750990", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db825cc3-e14f-412a-b127-90a549d94e90", "sighting_of_ref": "indicator--1d1790ef-bdfb-4299-acda-54bd3ce6f0a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fd15cc0-5e49-4577-82d4-8e1e5e6982c0", "sighting_of_ref": "indicator--450dca6e-e2ff-458b-9619-bf74fd50e31f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--098cb848-0beb-427b-9be1-c69e1c70d72a", "sighting_of_ref": "indicator--01df6d7c-eaee-4735-b256-7afca5027039", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c77c1f64-987f-4c76-8010-0b58e1bc09b2", "sighting_of_ref": "indicator--cd644306-1a91-4c40-9cbc-53a71d12e36a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3c6eb31-821f-443d-b4e1-364fa18f0b02", "sighting_of_ref": "indicator--8c34070b-1df4-4f07-96e0-6fb3c7f4410b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123f82dc-e963-40d2-bac8-a47afce39b5d", "sighting_of_ref": "indicator--235ebeb4-81ee-4f88-b1b7-780c5fdd1e24", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0981f0a2-92dc-491c-bed2-5cc6b4511830", "sighting_of_ref": "indicator--cac3ef74-1f5b-46c0-b152-2747adc24c46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee8770f-9658-44e8-8a8d-a763e408c5cc", "sighting_of_ref": "indicator--63eddf92-43c4-41b0-a766-b25cb5c76751", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e7e8cd4-073a-4bba-9778-4593c08109dd", "sighting_of_ref": "indicator--3a170cff-00fb-417d-8705-cbcf7a409751", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78057032-ef5b-472a-9e9c-2e9c48e5eb94", "sighting_of_ref": "indicator--3008485e-46d8-450b-bab0-efeaf685f4ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f6cad90-1668-41c1-b6bb-9169c641c18a", "sighting_of_ref": "indicator--5c01d4c3-f323-497e-a02c-4dfdf03e082a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--293e1953-84f9-4680-b4b2-151ba8fe3435", "sighting_of_ref": "indicator--69bee908-7fd8-4321-8967-10e1ea87156e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c4e0f79-3366-4e2d-a807-e4c5f6cbaeef", "sighting_of_ref": "indicator--87caa76d-cbb2-4f00-804f-2e48ee1ca76c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bcdc4fa-2cc7-4d68-bd76-5e6413e0c85e", "sighting_of_ref": "indicator--6379006e-92a0-4e14-b379-63d96d380a14", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--790ee0f1-20a9-4e96-8bec-ef7df0eb68df", "sighting_of_ref": "indicator--b1d8f09c-ed26-4cd8-a0b7-24b96c8c6f37", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f274117-6ae3-4aa9-93cb-7eff5d2e358b", "sighting_of_ref": "indicator--a17f676b-b6bd-4921-b52e-c26bcdedad5c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d36d012-6514-4e26-86b7-b26f383d13f1", "sighting_of_ref": "indicator--5f34b3fa-6ea5-435d-bf02-4f25b7f6e4df", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ec69e8-0c34-4efc-a10b-e98caee290d9", "sighting_of_ref": "indicator--1c8de572-241c-4b12-8a72-e9a10972fbc4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bfffa29-6db7-491d-bf43-362f8eff7ea7", "sighting_of_ref": "indicator--bc927ca8-c9b9-4041-820d-0ca31f619ff2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--412288fb-d044-4d0f-b6d6-5479fcfc98c3", "sighting_of_ref": "indicator--1ccc8f67-ea71-42a0-bbb5-dbde1ea2b804", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36f2bc4f-db87-4d44-a895-56c30a51e57d", "sighting_of_ref": "indicator--e28b60e4-d9c7-4ca2-9979-fdd544610cf2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a37f8fa8-2115-4278-8935-d8244c4d13b0", "sighting_of_ref": "indicator--329c3341-1c51-4026-83a9-124a02a193fe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d36c426a-5514-4556-8b4a-0cc9c152e44b", "sighting_of_ref": "indicator--f0d8de81-cbbe-4beb-bab4-3be75b560657", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0bc5eb4-694a-40e3-ab70-ec060bd67e3d", "sighting_of_ref": "indicator--314d69ca-a78e-485f-9df3-be142c234b82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a1e30d6-662b-4d31-99a5-876f3a5196dd", "sighting_of_ref": "indicator--7a40d76e-0876-4517-bd76-f6013bb10f77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87be241c-f915-4fee-9d6e-d101111b0fe3", "sighting_of_ref": "indicator--6047c854-a501-4bfa-9373-f10b21c4eb67", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df2a952d-6836-47a4-b1e3-0bc270bb2c6a", "sighting_of_ref": "indicator--691c4b1f-a5dd-42fa-812c-5ee6d3ac5dd4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91de80d5-fd0e-452e-a4b7-dea27138b389", "sighting_of_ref": "indicator--653ac985-ff6a-4d2b-bdbd-2c4b8024634c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--435a274f-0a20-4196-8db5-cd23d6caa5d2", "sighting_of_ref": "indicator--bea658df-6fa9-4077-a87d-f6b3a89a94cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--deacc1d3-5490-4425-ada3-82a2469474da", "sighting_of_ref": "indicator--1b738bac-0abe-452a-8630-29f425a4f156", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38dd2fa3-7fa4-4bfb-9ead-bf2d2a6f0607", "sighting_of_ref": "indicator--5c71b357-8d8d-46b7-bc2e-47c282486ec4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f64d5990-f950-4933-883c-eccb90bc8872", "sighting_of_ref": "indicator--368d87aa-c5b1-4b86-8900-87f3a4b40453", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5f84d1-7982-44da-9685-e12ef3dae22e", "sighting_of_ref": "indicator--5b2ea891-42af-405b-8232-093b297f94da", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e53bdf8-7663-4b4f-8a09-fd747acafe54", "sighting_of_ref": "indicator--1a0e918d-1717-4032-b53b-8f071da070d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d8d534-e883-42ab-98a3-956d557a89ca", "sighting_of_ref": "indicator--d28fe9d4-9293-43d8-8f9c-d5ddab147220", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f28e2b-c285-49cb-8c92-4e22b8afc958", "sighting_of_ref": "indicator--4dc14d11-46c7-4939-bde7-b48098a4974d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cc3d958-2f6a-4a15-a86a-681c9f8173cd", "sighting_of_ref": "indicator--f31b4eea-c136-4f0a-bd53-6126acbf243c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42ea108d-960c-4e06-9e13-01d3b41333fb", "sighting_of_ref": "indicator--bc4652a0-70ac-47a2-8429-09ed1f646d45", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ec52202-40c6-4daa-bafd-506bec2bc2f3", "sighting_of_ref": "indicator--13a65650-6116-4749-873a-be4e64984d4d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ada3a5d-d4cf-4c50-89b4-36b34c07319c", "sighting_of_ref": "indicator--59be663f-6631-449b-8cf1-b30f25e341cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0682dc42-3ae3-4f58-9215-8ba5fec67b74", "sighting_of_ref": "indicator--173e10fd-eb7c-48d3-89ca-f5982530fc13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1185d634-daac-4967-9d50-7db8b62d342b", "sighting_of_ref": "indicator--cdf567b2-adf6-4184-9a6e-3a52390d432c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a21d7384-97eb-4163-aeb2-3cae5c7fb712", "sighting_of_ref": "indicator--7d471e67-eaec-43ed-9a51-39442f140d2f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85151b31-9afe-419b-9bb1-440496837ac5", "sighting_of_ref": "indicator--65869d1f-bb87-46df-a722-9e13cd7ad335", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f5e7be-57ce-4051-84d4-79b6b830833e", "sighting_of_ref": "indicator--1165bf21-d501-4cfa-9519-a03c132107d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91e41d9a-2378-4816-bcc9-ece6d7638b89", "sighting_of_ref": "indicator--2a2b2071-045e-4997-b37a-b17e23e3e5d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bbafb33-e787-472c-8efb-8282fa437b3a", "sighting_of_ref": "indicator--57635d6c-746f-4692-b5e3-da6e91238bf4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63b006b-dade-4350-bb2f-3a53faef02d7", "sighting_of_ref": "indicator--add4b4e9-30be-49df-a57e-bd312a443dc7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f95f40cb-e968-45b7-8236-8368dbd3f388", "sighting_of_ref": "indicator--a9aa2013-9d97-4c6e-86e5-2d2116445801", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e52c12a5-055f-4dd4-bce5-84ca369672fe", "sighting_of_ref": "indicator--bb5933ef-10b1-486d-a5c3-b2e7328d0181", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4477a99-f676-4897-827c-0ba5b736ac0b", "sighting_of_ref": "indicator--b7929611-b4ba-44a5-9046-6a2ac8ac611d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4328db63-e5b0-477b-8bba-c2539af18ffb", "sighting_of_ref": "indicator--2ce654f4-cb2a-4feb-8cb4-a13607a2cabb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e1fd013-59a9-40b1-8c2e-2c4f37c20025", "sighting_of_ref": "indicator--47ea75d1-bc42-431d-93a9-c7f86cd8a517", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1436582b-04c6-4ae0-9339-f80451284501", "sighting_of_ref": "indicator--0a2ba099-2650-4ddc-8f92-7ca250abe739", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f5aebe0-f5be-4f98-8017-7d2fcd529fbd", "sighting_of_ref": "indicator--aeffc54a-326a-4bd7-8c5b-75085a703341", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8159df51-8d97-4ef7-ae43-c15e67fabdc3", "sighting_of_ref": "indicator--fa638b8f-9fea-48c4-bc4b-ba8e0ebdc162", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7946286a-a266-43b6-94e1-37ffb6d5e84f", "sighting_of_ref": "indicator--515e10e3-5b2c-4e58-8136-dfd94525505b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8544388-7297-40a5-8fc4-1265fdc37a98", "sighting_of_ref": "indicator--143a932e-7ce7-4d29-a62a-a67db2a0bf8d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db7dedc5-c967-4c03-a813-85e92ad83759", "sighting_of_ref": "indicator--94dd8b22-404a-4a13-a574-afe3666ec979", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b8082da-6e61-4a97-a525-05cf7dabfa8d", "sighting_of_ref": "indicator--81130dff-e104-433e-b3ae-40854b5c726a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e49ec2a2-7eaf-4f85-ae5a-a21db93e5b3d", "sighting_of_ref": "indicator--b46000cf-7829-413c-9c02-b1a633a2af84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3be585c-4e21-4eec-bf89-9efc86d5c181", "sighting_of_ref": "indicator--997f6827-b3a3-447b-a727-f376e676588b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c05ed0b2-e0c2-4c0c-8435-d22361aebe75", "sighting_of_ref": "indicator--a9c137a3-8363-46e0-8707-5b6157c0b7d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7309a55-85f7-4544-a60a-dd34ab38da24", "sighting_of_ref": "indicator--e7bd29f5-623e-4abf-93a9-8c251838ddc5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1f7b2b5-6707-4cf7-9ca7-6d133ce7d3f0", "sighting_of_ref": "indicator--f1de04fa-d24a-45b9-8fa9-bcf87d97b5c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--406d4187-c170-4e71-aad5-7076b6923da8", "sighting_of_ref": "indicator--38ed1fd8-4913-432b-a6a5-accf98cb5653", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c567296-be1a-4a8b-b224-83e19c06181f", "sighting_of_ref": "indicator--f11ae55f-0beb-471f-ad54-c45614786fc8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--400cac25-82ed-47ee-b649-96a7b10dcef9", "sighting_of_ref": "indicator--8e660bf4-1da3-44ac-b8c9-244bb9d14655", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22658ce6-aea8-4f3d-ae96-e678ceb67584", "sighting_of_ref": "indicator--2f808885-9171-402a-bad2-6888a611891c", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5085cea0-a344-454f-a496-b7977bb13f61", "sighting_of_ref": "indicator--2f808885-9171-402a-bad2-6888a611891c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffffc4c4-f16e-463b-b337-08fd1050ea5f", "sighting_of_ref": "indicator--2dd899f0-6933-487f-a514-0a305bd4b4a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f4968fd-23fc-4696-a262-b34c19806dec", "sighting_of_ref": "indicator--756bf504-d259-458c-8ec5-5c453338a55b", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a87f2fd1-75e5-4ab0-945c-04aa810469c3", "sighting_of_ref": "indicator--756bf504-d259-458c-8ec5-5c453338a55b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b971331-7838-45ea-addc-4131f9d4b4bc", "sighting_of_ref": "indicator--d738e354-e370-4ad8-8546-2adb2278356c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6998cd1f-2c25-41fe-b93d-8bf8ff15eab8", "sighting_of_ref": "indicator--d738e354-e370-4ad8-8546-2adb2278356c", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c394d22-2d00-4d62-b5e1-14c1a7f24f20", "sighting_of_ref": "indicator--459aa3e1-9496-4ccb-a7f6-6911371d6d2c", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c134efb0-3644-426e-b3a5-c821454f1091", "sighting_of_ref": "indicator--459aa3e1-9496-4ccb-a7f6-6911371d6d2c", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86b5224a-a674-46f8-893d-c39212a1c51a", "sighting_of_ref": "indicator--459aa3e1-9496-4ccb-a7f6-6911371d6d2c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acdcfcf7-6be0-4417-907c-2c5971f07ff1", "sighting_of_ref": "indicator--864a33ad-f080-4989-9792-d19653e0879a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f628d2b7-9946-424b-af72-f5dc8fd2c42e", "sighting_of_ref": "indicator--d4e97e22-744d-42e6-9d30-82d30c425094", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbde3b55-2afc-4306-9601-a1f9fff7f5e6", "sighting_of_ref": "indicator--0b92efa1-1912-4051-9511-484dfcaee4fd", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e70153-c6da-4506-80f0-dd92d749ae3d", "sighting_of_ref": "indicator--8c61a7f7-10da-4978-9d01-efbcc7c388e6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ccb0980-82b6-4211-8f62-1b4c0712af0e", "sighting_of_ref": "indicator--5fb0e2d1-6645-4d9f-9e57-34e9e63ba4a5", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33d3259f-f373-40a4-bab8-b8d0c5143a14", "sighting_of_ref": "indicator--5fb0e2d1-6645-4d9f-9e57-34e9e63ba4a5", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79763fbd-11c9-49fb-aa6f-6fcd4e11b03a", "sighting_of_ref": "indicator--764b5bb5-cca5-4bc1-847f-aea14069ec7c", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1030fe74-f2ac-4b64-bf90-c4577d08bfda", "sighting_of_ref": "indicator--16012ceb-8b27-4ef1-b8ee-28cf1d5f292e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d63213-752d-498d-9a9d-5d46bd28d886", "sighting_of_ref": "indicator--b831c788-f30d-4fdc-9baa-ac902638789a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc91594e-dc04-41cf-855c-dbd1608b7290", "sighting_of_ref": "indicator--9db6a0d9-77e6-4842-a856-d18c5413be73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afd92e40-9615-44a7-ba2a-aebcdc9c89d9", "sighting_of_ref": "indicator--2e2bb02e-d4c8-41b7-ba03-804dc1635aac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6786aea4-cc7c-4a15-99b4-52af724524ca", "sighting_of_ref": "indicator--2e21782b-c38d-4010-af67-b0a5748a09a3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce6df2a6-23b3-405c-8a63-fd10ade98e3a", "sighting_of_ref": "indicator--360de330-f639-4a31-a09b-72f6bad08e74", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6188f43-0a4e-44c6-a0b4-321695bf411d", "sighting_of_ref": "indicator--b1f96848-65a3-445d-9e30-8754f32e09c1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--216de697-a208-4084-af23-a85895052865", "sighting_of_ref": "indicator--d2242e35-ddb7-4264-973e-405080b68765", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07080e73-8709-4188-ae7f-032acbc3261a", "sighting_of_ref": "indicator--ff9ba31c-e7a3-4a4d-b1cf-f863c5b7407e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bcec59a-735b-49f3-b611-6d9b03632850", "sighting_of_ref": "indicator--8b8905f6-f5ec-4008-9ed8-8a31af343965", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c722952b-65cd-46e9-82ad-a6202442729c", "sighting_of_ref": "indicator--65c46c9a-7d0e-40a9-a37c-c1962105e6cc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1b22fee-d723-4b27-8200-c97dc2d75123", "sighting_of_ref": "indicator--65c46c9a-7d0e-40a9-a37c-c1962105e6cc", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47dbf83a-27b8-45a6-a1b0-41db0b2b511f", "sighting_of_ref": "indicator--44af3542-7914-4d2b-b67a-cd8ea4fc9a57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e2cc86-1bc1-4024-b40a-4deadb3dda59", "sighting_of_ref": "indicator--ffb25202-ac9d-40a9-b2b7-ea37ae0a311e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9ac84f-06d1-4fba-ad4f-6bf4e04bbefb", "sighting_of_ref": "indicator--febd0eaf-62b8-47ce-ab6d-c3343206ecaa", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a66c1982-b646-4385-a69d-e22c408fbcf6", "sighting_of_ref": "indicator--44c057a1-49ee-410a-82ca-da93bbb8d6e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ca93bb9-4d70-4f85-9cb6-b7c98efdabef", "sighting_of_ref": "indicator--0c92cc49-ea8f-4b22-8ef0-27a898e500ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b033d319-7bfb-46cb-90d1-865527f90c73", "sighting_of_ref": "indicator--deec25bd-812c-4fc5-a9d1-ff802e8110e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58f3b93a-8e67-43a3-9d0d-64c0a32d4dcd", "sighting_of_ref": "indicator--137f0801-1a4a-42b4-b205-d994ecc06c07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84586fe7-09e1-4ce9-9d88-57761fe88474", "sighting_of_ref": "indicator--80d987b7-5541-4b90-ba2b-fea7c994b84f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--051765b0-1d52-4f92-964e-c4f6fee6a313", "sighting_of_ref": "indicator--5641a692-bba6-40e9-89a2-f3c59b6e9a16", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81d1e6d5-f53c-47db-8bc0-47a832ae003d", "sighting_of_ref": "indicator--9b0fe644-899d-48f7-80aa-9fa315fe15f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--833c211b-0990-4286-a970-99fd63a51cb6", "sighting_of_ref": "indicator--a380fe45-b38d-4d81-bef5-20c28d7cb095", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451a37ae-dee6-4ee3-bf47-b0d66726cf3b", "sighting_of_ref": "indicator--c3c10da5-42c3-4874-bc79-4f77cc6f9c3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ecb3ab0-fc97-4f1c-ae21-fe55d17da76e", "sighting_of_ref": "indicator--d007b960-9fdb-4992-9223-654f649046d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63406102-e850-4609-8bf2-4bbc0c78ed13", "sighting_of_ref": "indicator--c2f218b6-2359-4659-85fe-2ac519408428", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02e06b7-3aeb-4623-ade2-76fe1206cba2", "sighting_of_ref": "indicator--bca96b8c-f9dd-4457-b091-e635ed321a4e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28494716-6b5d-4590-bc0b-b274af122e94", "sighting_of_ref": "indicator--2744aeeb-4b7d-495e-862d-59c0c9c9e6fa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80cc70b5-8012-4715-88b2-7769e062bf4a", "sighting_of_ref": "indicator--4a1b97ce-b356-48f6-a7e5-0642d6f4390f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff3f44f-92de-46dd-a667-a393ec831477", "sighting_of_ref": "indicator--3b1b2750-8a86-4e50-97f7-776b8895c1cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--372e1804-5022-4706-bd22-9844687cfd2d", "sighting_of_ref": "indicator--f6d29bea-1b42-448e-889a-b129a444ca21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80f37863-0251-488c-80eb-70e5f306bbc1", "sighting_of_ref": "indicator--3a439422-4018-49c9-a4c4-fa6bd82e2318", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2b82254-678b-4eec-83cd-fcbde59e3d72", "sighting_of_ref": "indicator--f5721520-4815-4786-ace5-7e18c36dabc4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b87044b2-54cc-4669-9c9b-76ca8e5a5743", "sighting_of_ref": "indicator--2cc1aca3-1665-45f0-b46c-526264802333", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8160010-4b81-4b91-8e9a-375ed8819327", "sighting_of_ref": "indicator--83fc01fa-0dd5-41b7-a3c6-ed6d1a8d0d08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3f7302e-a26b-415b-9c10-1fefde9b8a58", "sighting_of_ref": "indicator--779cb795-a704-4f38-b747-767b3339b827", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f1e5701-8e56-4128-a57f-364d4d4c616b", "sighting_of_ref": "indicator--49c725c0-ebe4-4abd-9880-472d3f5ea77e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab025ff0-2b89-4592-be1b-807b228a4263", "sighting_of_ref": "indicator--b95325cb-1f95-4a93-a62c-aa65e663c4c5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37c2cabd-0fb0-4088-a1d5-e083519f4fe1", "sighting_of_ref": "indicator--ea3da258-ff22-46cd-a6b5-bcebe75a420f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21afcf9f-32b7-43b6-83d2-dc011b5d9212", "sighting_of_ref": "indicator--e9f69428-0a11-40ef-8183-f7c350df5320", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e1e2e19-0958-4efc-9b3e-86c4e347d614", "sighting_of_ref": "indicator--8c9faef3-11c5-44eb-8d65-a2a1e9104e51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e6f9d62-1ef8-46c2-bc30-8115067c2eb2", "sighting_of_ref": "indicator--15c59d3f-9eac-44e5-91bd-6b24947b9700", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0426ff7a-9a81-4a39-8e81-611933ec1b84", "sighting_of_ref": "indicator--cf1f4425-ee16-44c8-a1e3-05dc42b8a2cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18aea71d-c789-4ead-8750-b42323d36dbc", "sighting_of_ref": "indicator--964ee1d9-2bf3-487c-a228-09768a7e0c7f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c46050-cb45-4b8d-83c4-12864e05ebf8", "sighting_of_ref": "indicator--42e65680-197f-4d61-89db-c4c6bbb894a5", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5192c6b1-1b66-4dba-ad83-3cb32dece406", "sighting_of_ref": "indicator--c2e80921-14ee-4a44-b032-4be0db77d3f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb9a7d1-32b7-4e1a-afa7-ed7195487f30", "sighting_of_ref": "indicator--64119b57-ad89-48bb-ba43-f1ea2b8c6e79", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdde9e9b-b1ac-43d3-bc4b-80dd6a0d282a", "sighting_of_ref": "indicator--5cb22394-789a-4b9f-ad3a-1f878fbe83c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97fdfed0-85c1-480d-8530-acf722202c3d", "sighting_of_ref": "indicator--447bbce7-1b97-4bb0-a2e7-adb7449a21f0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30155138-ef5a-4680-9fd4-93acd88e0fe6", "sighting_of_ref": "indicator--3e0ce351-ac6a-48c0-b477-d0bc973e391f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c3249b0-a2a6-439c-ab0f-277823dd6dd8", "sighting_of_ref": "indicator--9ac93261-e7c2-44b5-a1e8-eb387a36b134", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe48cee-e564-43e1-baf6-3f5ed4c4f735", "sighting_of_ref": "indicator--4a7276a4-b2be-4c3b-94bc-21e73561c84f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--106f88fa-bed4-4e5a-ba1a-819b1bc0ae54", "sighting_of_ref": "indicator--631eccad-e0aa-4651-b029-7bdac8fbaa97", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a82f2975-58ec-4b14-902f-d671ce71391e", "sighting_of_ref": "indicator--c99e1010-8adf-47a0-bfec-e6d91d30aa99", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee168f5-c25d-4079-9702-f77c8ab91e93", "sighting_of_ref": "indicator--4fa87e41-8254-43f1-bff0-f52b7c7dc0cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc29c847-8e42-4051-93e7-2856e35f1a74", "sighting_of_ref": "indicator--5cfa8aa5-57ea-4ec5-b674-47608c071e07", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--399e83af-9c07-4d5a-9e10-f07a7b8d1acf", "sighting_of_ref": "indicator--7637c631-886f-403c-affc-ef4ffeb1e81b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b571c2fa-8838-43e6-9cd3-aaaef8ad4032", "sighting_of_ref": "indicator--c6eb4671-abf6-4084-9234-b863b8493397", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e0706db-5c17-4b87-ba2a-e972b4bac4f9", "sighting_of_ref": "indicator--0356bafc-f434-454e-88dc-2286f53ff4ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6407f497-bd84-4ee7-8276-ad2fffc2154d", "sighting_of_ref": "indicator--e1774bfb-e78f-4055-bc89-7d6d8c4013b0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--163d6d3d-69ea-4f80-81c7-58eed905b252", "sighting_of_ref": "indicator--0041157b-7dde-4237-b3a5-063019e263cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48a5a795-2518-4fb7-92e2-3d72819dd689", "sighting_of_ref": "indicator--1e42470f-c4b4-44fa-8ca3-b0de540dfde9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f4f7f80-680e-40b9-858d-9357b9495337", "sighting_of_ref": "indicator--6888a863-4b4c-4c74-aeec-c59d7315936b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dde57a74-2817-41a5-8d64-3809006ab25b", "sighting_of_ref": "indicator--e6d63300-8a3b-4866-b4d3-e89d5900acd6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798e1174-dc4f-4e63-9d79-1f0f3202d5a8", "sighting_of_ref": "indicator--aa63c4f8-8520-4e64-8baa-cc32e88a7e57", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e67e186-4632-4480-9def-6a00bec262eb", "sighting_of_ref": "indicator--1621489f-42c2-4941-88e1-fa68c662d2ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9aca2b23-cd4b-4e5a-9e52-ab143de02984", "sighting_of_ref": "indicator--c99e4189-e04b-4845-ac14-a3949851ac77", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3cf9d30-6fda-4f09-a6b8-d84c57861ce1", "sighting_of_ref": "indicator--97489361-7334-4209-b22a-d3737bc36535", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f04093a5-3303-4a38-8cd1-df9acbe74f46", "sighting_of_ref": "indicator--3292f30d-f7b1-4990-ae81-cb5196e241b9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d01cbf76-744e-474c-b34d-49bdeaaea998", "sighting_of_ref": "indicator--7481ef4b-8959-42e6-a4b3-d59045880935", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8108127-b04c-4185-b829-dcc0dbc24788", "sighting_of_ref": "indicator--d2e933ad-7c4d-4bd8-aa87-eea68f16eb9e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd373295-8e94-4832-98e3-4096c1ecfb73", "sighting_of_ref": "indicator--68c7d1dd-6a3f-4589-88d8-3a0d8e1b54ed", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04dd65a9-3da9-4f0c-aeff-8078873d4fc7", "sighting_of_ref": "indicator--8e04ca10-8075-476b-9cdb-ce87637c0f1f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a0d365c-2412-422e-91eb-49d398584a2f", "sighting_of_ref": "indicator--6e19b425-9265-45ef-ab5b-70f3a4f063db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b330b901-c34b-44cf-9f0d-6eba99b410c7", "sighting_of_ref": "indicator--0fec2481-c4f1-40b0-a614-cad78c4241b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bce1668-1421-49aa-a2ff-ae0026a106c0", "sighting_of_ref": "indicator--b88c7c67-1abb-40c4-9f06-4ea4eeaccc30", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe457562-a842-41d7-8f31-2455da72215b", "sighting_of_ref": "indicator--422f6dfc-689a-4e8f-82e4-9166c8843c04", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a7673b2-e707-4685-a443-3e285c0a3059", "sighting_of_ref": "indicator--23b8cf60-3e23-4b35-9c44-56e59d07c1bb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aba16fe-a7b3-4501-adc0-a97d2c9ad2be", "sighting_of_ref": "indicator--f0cf19b1-a671-43fb-9ccd-b9ff44a43ec7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1d66e21-6ddf-4dc6-b035-b6a30195222b", "sighting_of_ref": "indicator--135fccdc-2a42-4c6d-85a9-8adadf589f8b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db37a491-de9b-481f-b44f-a68387d2c8f0", "sighting_of_ref": "indicator--d578b24f-53ff-4e08-9494-22c4377cefcf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bec6e75-1848-4740-b110-d2d88623686e", "sighting_of_ref": "indicator--3b14f2eb-1a30-4d90-af25-bc69ded26def", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c94d09d0-5d4d-4e0a-985d-2fa129cb5870", "sighting_of_ref": "indicator--c14696b3-39aa-4c8c-99f5-b8cb808a3c49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f8821ad-6bdc-4fae-a01c-9f76ef196d51", "sighting_of_ref": "indicator--cf1e0310-a3aa-4251-b636-a0faba23e0de", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5db31d4-2b3d-4252-b8f7-cb8f25158559", "sighting_of_ref": "indicator--e18b7bfb-5adc-4bf9-a7fb-ccf78f53e3f9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--155289cb-14f2-4d30-8922-e22acdf84b24", "sighting_of_ref": "indicator--1f34f294-bdc2-49c7-a9eb-020970dfb393", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd923856-34c0-4248-bb01-a34d90f6a0f2", "sighting_of_ref": "indicator--6725d1d6-5432-4307-a98e-b7e978fd23c6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25071034-aceb-4f18-a2b5-133132c26c33", "sighting_of_ref": "indicator--ac600790-21c5-41c3-865e-0b1618245fb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbed0a2d-0dd1-4dc5-b06d-738b2efae289", "sighting_of_ref": "indicator--6c1de0e4-cb3d-4bd9-b3d5-2430253c98ff", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0db2360-7b3e-4f03-9048-1a4a931e4926", "sighting_of_ref": "indicator--c92551b8-f28a-4949-bb7b-25de0fd20338", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38665ef7-2dd3-4f07-abb3-3a75be54103f", "sighting_of_ref": "indicator--5a1689d3-da58-4936-b456-e0b0e7451317", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac522325-7c5c-402c-8b81-f8e351e20ae4", "sighting_of_ref": "indicator--aadf06d4-b302-4ffa-b9d7-8debe9e9fa9c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74204e7d-a8ef-4ee4-8d29-1ba10bae952f", "sighting_of_ref": "indicator--9cdbae87-3a53-4cab-820a-3c9ce9b78d49", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0ae62cd-929d-41ae-bfae-188d073d824f", "sighting_of_ref": "indicator--d0739aa5-f1f2-43ae-8a44-001a88f2bcda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--debf382b-0f18-414a-989b-102e8174157a", "sighting_of_ref": "indicator--8ea9684c-d6d8-47f6-9aa5-c892e2103d4c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--028b88e2-7d78-448a-91d6-2c5592432662", "sighting_of_ref": "indicator--f1f5b36b-373c-4250-bb91-fbeb87841838", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c39206-6f9f-4c51-8e8b-6fdcd62a65a2", "sighting_of_ref": "indicator--64c9b081-abd8-4343-84d5-3fc95e11c9b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5eb7e121-4d71-4fd3-a414-4da34c5f1352", "sighting_of_ref": "indicator--91df94d6-bd88-4f31-a3ec-5316d150d1e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f27bdc7-5925-4ce6-957e-d6aabd9db304", "sighting_of_ref": "indicator--9dec430a-5e34-41ad-9b4c-49f50833eadb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d89d70b6-4b26-4e1e-9dfb-a0759c8221bc", "sighting_of_ref": "indicator--338b4e4b-9b00-4ee4-bfc7-fa72de1e5a81", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9296903c-d645-47a7-b73f-d5e6e6362f7e", "sighting_of_ref": "indicator--14a7ba78-7450-437a-bef1-a365f3775d41", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--624251e3-20f9-4b7e-8fc9-f3cad09a7738", "sighting_of_ref": "indicator--19a5c31b-8b49-405b-9e95-2a6f4eb78a84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--021fa57b-c0fc-4593-84a3-8708d509f95a", "sighting_of_ref": "indicator--1bd26bc0-2e22-45c1-9b0e-5cd95dc63081", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b55d508a-3977-44e3-8bd5-551ec80ba580", "sighting_of_ref": "indicator--0a9957c0-7d8a-409c-830c-1bf537eb256e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6edc4dc2-dd3f-4bda-ba96-364e0c496f40", "sighting_of_ref": "indicator--3cf8eb5a-f5a7-4fdb-bbab-19a64d34595b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87ba4179-f3b9-4ae8-a774-0379dc77ef13", "sighting_of_ref": "indicator--2ecc65a1-1830-40d3-b3ba-62d029913663", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561b4aad-86dc-4749-93e3-2f9678cfb1ab", "sighting_of_ref": "indicator--35541a29-3e21-49cd-beef-dbab9b61d945", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da315c64-02c3-4832-80b2-fb8329358623", "sighting_of_ref": "indicator--d08711c3-01b4-4645-beea-c35a32cadf59", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14fc6a7f-5304-4868-8c84-38341fcb0ca1", "sighting_of_ref": "indicator--a6c6356b-1204-413d-9f2d-7faa0dc793c9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c4f077-de76-4fc9-b389-d5514d270211", "sighting_of_ref": "indicator--10355b48-83fd-4684-ba43-02c2825fb3f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--647bd177-8f74-4804-bae4-707f700daa02", "sighting_of_ref": "indicator--fcac31a1-9164-4208-86b3-59dc4fcbd1e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--039c2382-2aa1-430d-b39f-168dec9938ed", "sighting_of_ref": "indicator--1419a21b-22fa-4182-ba5e-a637b5575e0d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--654b0447-3b30-47c2-8410-bd59e774748b", "sighting_of_ref": "indicator--19d632a3-7c6f-4f89-9428-9dddef7a0bc2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2246dff9-ccd9-4eec-96a0-6b69b0fc0daa", "sighting_of_ref": "indicator--df9ddc63-6d6c-453f-b550-8f5bdab438ae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a33b805-839a-4a32-bb2b-8b24fe7d94b8", "sighting_of_ref": "indicator--8b981663-92b3-482a-91ba-804a7c12d1cf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9535da8f-a1bc-4204-973e-7bff1de5fdd8", "sighting_of_ref": "indicator--a7cb213a-7898-4fa7-a9a6-8633d2c5bcde", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac93e401-4c6b-4808-a6c0-7e7b280bb384", "sighting_of_ref": "indicator--a6cc5693-87ef-4571-90b7-c49a957b9a84", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe518529-83f7-43c1-a675-1d4d065f54ba", "sighting_of_ref": "indicator--4f16ed7f-4a9c-4b55-ba2d-b9fd0f8a4ac0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4a0cc4-2041-44f4-8430-61ec07a4a1a4", "sighting_of_ref": "indicator--9e90a16d-ce0a-427d-a7db-d2ebc5afbbae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32502985-ae48-4d0b-99a1-85696f3f9306", "sighting_of_ref": "indicator--e522521b-e8bd-47c8-a1a3-eee4cb0a043f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--809c03f4-cf8c-4a3e-bae5-fab0084399fc", "sighting_of_ref": "indicator--80ad4bdb-d851-459b-a409-fd62baeff6b8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e586c7e7-768f-42d5-9c71-38eb47b2ac32", "sighting_of_ref": "indicator--ae1add67-ade4-475b-b547-f9ceab92dd8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0243e16d-be30-4912-b2ca-37229e188a91", "sighting_of_ref": "indicator--1e2723bf-45ac-4cbf-9e96-550023ea0713", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc2b58a9-64c1-4e96-be7d-8a98f81bd57a", "sighting_of_ref": "indicator--8b0a6657-393c-434d-8d7c-1ec8891d5f9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5ebaa52-0045-4e77-affc-449ff1451716", "sighting_of_ref": "indicator--8976d281-8bed-42be-b7c6-89a4354d87b5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a9bdd0c-9186-4464-94bd-d2008188dcc2", "sighting_of_ref": "indicator--c9c1918c-cef9-4a5b-91c9-e99ea2a64a4d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20b8a9de-78e5-4ed0-a7a8-cdf98c38e9fd", "sighting_of_ref": "indicator--e6f3170e-f663-4569-b1cf-654b4a446060", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8dc2475d-8fa5-48f8-9a15-f68efd5b6441", "sighting_of_ref": "indicator--6826ad69-a0e8-43f2-9d37-5b67ee1d5ee6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90961862-1597-45f8-ab02-4557125bc9a5", "sighting_of_ref": "indicator--1a243814-0546-4bc4-9400-4d05a2328dae", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb69b85-d095-4909-b3e3-f7e61c2dcf8d", "sighting_of_ref": "indicator--a026f1bd-1e97-4504-ae4f-a2e41f26652d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df16b778-8ce6-4f51-ba3a-094fed6808db", "sighting_of_ref": "indicator--eb5e7305-b301-466e-8421-2f110faaf3bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53a775a2-8fd4-4028-bd19-75eca728705b", "sighting_of_ref": "indicator--ebe58a3b-9607-4ba0-93fa-dec8ceef07ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adb8781e-ddab-4ab9-af58-28d650d67624", "sighting_of_ref": "indicator--6f19aed3-38d6-4cab-a9de-4203ec8116ba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337bf015-80cd-490a-ae48-612c6838aa25", "sighting_of_ref": "indicator--53efa272-6cb2-450b-9456-f3b6c9060154", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--513e8a42-c50b-4344-8abb-427d8fffef10", "sighting_of_ref": "indicator--137264e0-ac36-4c9c-a6be-f0ffa3cfe3b2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2d5b20-c2a7-461f-b838-2c55aab3c9da", "sighting_of_ref": "indicator--dcf871cf-32e1-414e-995f-a2bba60edd7a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8495467e-c583-41d6-babf-7de61fa71946", "sighting_of_ref": "indicator--a7bf8085-80f5-4cef-89d4-984020b01136", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9e1c3f0-5b0f-4fc3-a4fa-7c09cecda121", "sighting_of_ref": "indicator--e0330c83-58fe-41dc-b50e-c76c6c853b09", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22dd0e76-22c6-4764-896e-cce2b385db47", "sighting_of_ref": "indicator--09985621-60c8-4934-b740-45e677ae95d8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac78b6c-d086-4a62-b0c2-c2bb05a00078", "sighting_of_ref": "indicator--0e073a53-3c61-4fd2-bc16-18b765b315e3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269531a2-7aac-40ec-8a42-f28255eb491c", "sighting_of_ref": "indicator--a1cb03ff-b5dc-4c3e-b625-3f3914d08d34", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50d1a68a-49c8-484c-b4e4-7a2d230b7718", "sighting_of_ref": "indicator--bab3943c-4abf-4408-85cc-348a2ef3a7ff", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b84c0350-1506-4e79-920d-66b762681e2a", "sighting_of_ref": "indicator--3e98f383-a0a1-414b-9fca-09a3111fb63b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c0e41a-f0bd-4743-a358-4598c1bff416", "sighting_of_ref": "indicator--5dfbebc0-863b-46b3-aaf3-4c650249b350", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cff48b77-b5a0-4465-867b-20c79ccbcf2a", "sighting_of_ref": "indicator--bf8bb9de-52b5-4e41-8e35-115c9e505f48", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1c56bd9-ada3-4c32-b5c6-81d43debf5a4", "sighting_of_ref": "indicator--192f7650-db6d-454e-a9c4-fbadc62636a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc9c5579-03dd-4c7a-a454-7e8b2b420aee", "sighting_of_ref": "indicator--d4abd532-90bb-42fc-81da-af8e1a7d35b7", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25808c70-784b-49e0-919a-912339ae8e4d", "sighting_of_ref": "indicator--245b1d7f-2a52-4030-a20b-6809e2588532", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8606d268-58bd-4be0-bcf5-7915621a5c99", "sighting_of_ref": "indicator--f219ff42-aba6-4409-a024-9182199038e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74dbb116-d16c-42e8-a423-bbfaef6b7347", "sighting_of_ref": "indicator--c21da455-0ac9-4c6f-b19d-7546855c208b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aefeaee-5a12-43c4-84a8-e42aa5f32764", "sighting_of_ref": "indicator--f291623c-34d8-41fd-b37a-6c1102a43bd2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ec30c27-7aee-4c13-9c6b-0f22e2407fda", "sighting_of_ref": "indicator--6dccd274-f081-4f83-9402-3f3c6b565da9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbb19bc9-0280-4531-945c-29e208529a90", "sighting_of_ref": "indicator--5a730efc-b8dc-4148-89c0-a0ab560bd316", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a482ce1b-2609-45dc-b892-490a2c8c5665", "sighting_of_ref": "indicator--326b4d0b-51fa-453b-bbe3-0fb26bfad071", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc3af216-97fd-4360-a799-445c23d2e601", "sighting_of_ref": "indicator--9fa2aaa3-4329-4a02-8dc0-a70ca86b7826", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cafafe45-63cb-40ea-b2ec-816e8fc1591a", "sighting_of_ref": "indicator--791d9ca1-9843-44e8-a0e3-c59fc777374c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4848ec26-217d-4669-8597-b2044120d444", "sighting_of_ref": "indicator--8bcc63fb-1c0d-4c32-9a8e-24eab4410528", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ada2e0c-527d-49cd-98f4-0cbb14b4ed01", "sighting_of_ref": "indicator--8e3314c7-702a-40c4-8846-35a49cc9eb68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f78ba48-2c87-4a53-8794-99bd14d694f1", "sighting_of_ref": "indicator--e3eb233a-0425-4ade-b3d6-05cdfb6ead82", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff042978-e45d-4537-8e4d-f6641629115b", "sighting_of_ref": "indicator--4c23c4fa-a311-42e4-83aa-eeda855b2ce3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec07b63-0ce0-4b08-a88b-a47c979a5066", "sighting_of_ref": "indicator--0e87ee41-44b8-45e4-86f1-2fcd447157dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--542e7233-eaaa-45e2-8b4c-b43e08d3a588", "sighting_of_ref": "indicator--eed6b5d5-8b92-4d00-aac7-4a54b266177f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d95ff16-6ec4-4262-9284-4cec1b8ba2dd", "sighting_of_ref": "indicator--6e094608-0daf-4aba-a734-11ef163423ca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--754239cc-b22c-4018-9e40-def93956a405", "sighting_of_ref": "indicator--30a1b50f-1b48-42a0-8a05-305eecb108d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53d0666e-bb1d-427d-ac77-dd28db79fde2", "sighting_of_ref": "indicator--bf027123-cb9e-47d9-87bf-f32f272fc0bf", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b1b2010-5ecd-4333-8508-17400757f945", "sighting_of_ref": "indicator--70f9b2e0-3046-4df7-acf0-be1c18c98d13", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99b2fb9b-2b80-4332-bf25-fd1802757147", "sighting_of_ref": "indicator--dab9a7d6-4ed8-44e8-8077-0f35871e7e55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a654772e-c16c-4089-a1bb-72d430373607", "sighting_of_ref": "indicator--a731423e-2685-4bb5-804d-95425aac6def", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9938615b-afe3-44f9-9b30-47436023b145", "sighting_of_ref": "indicator--e1138f51-334b-4793-93ce-9eb792d4ddcc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c297f356-5c89-47f3-b8b3-b72fef8e70af", "sighting_of_ref": "indicator--ef11185b-1dd2-4357-a849-5b6929dcff47", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0700577-c614-4b77-b607-8c60b174e381", "sighting_of_ref": "indicator--713b4e48-0ba3-41d5-9612-8d8d593b3bf5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f8463ef-7f9f-458b-9f6e-87750732c575", "sighting_of_ref": "indicator--ade5f7e8-106e-4f19-a9a4-e0480eef89ee", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e425f86-3a1d-4965-9c39-ac731b32a9a4", "sighting_of_ref": "indicator--9c2152cc-8aa8-49ec-8e83-47f5522f6309", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a057aec9-ed7a-4754-a9b7-0fec19372f42", "sighting_of_ref": "indicator--5ce4d93a-32c5-40b2-83f3-b12f64a93bf8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc40c2fe-98ba-4e02-99be-00ba34492241", "sighting_of_ref": "indicator--0d504bf8-3136-45d9-a418-2cbad870e3eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba94910f-9638-443b-b869-637c0506d3fb", "sighting_of_ref": "indicator--410829ff-0462-4ad3-9e10-d28e88c30aa2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f1c2f06-4f1b-4775-8e08-1b7c5beaa60c", "sighting_of_ref": "indicator--135bb335-af04-491a-930d-666fd0c4a8f4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac8f2c9-1a3f-42a6-affb-d806976ef8f3", "sighting_of_ref": "indicator--d40a194a-68f2-45ac-b6eb-5e66f3010d92", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66b0937d-357c-4b7f-9f51-9eb74d280855", "sighting_of_ref": "indicator--9eb79925-950e-4389-9912-bfb0a9726c0d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90719922-fba1-4907-b671-38183e4f4c82", "sighting_of_ref": "indicator--2ebc2db8-8fc9-4dd9-8bfe-634a4db5309b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f30e55-82a1-420a-a38f-78abfb64a826", "sighting_of_ref": "indicator--bfb4591f-868e-414e-aba0-f7f7e658cc25", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b1a3cf-1ded-409a-90c3-695a5aca5729", "sighting_of_ref": "indicator--0e0810b9-9a78-427f-9b4d-c2566ecadc52", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5cd6d39-64da-4af8-892d-db1245511157", "sighting_of_ref": "indicator--074b3a25-07c3-46d8-b8f9-32c3ed5c8990", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7decc042-a8cd-4035-9d50-65099c7ef2fb", "sighting_of_ref": "indicator--22ca1914-b093-44d2-a82b-8e10cb71be90", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--998ee0f6-413f-4360-918f-9fe6b4ab102e", "sighting_of_ref": "indicator--035986c3-fb64-4f03-8094-0aceda61f8f8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d00c5e3a-9b8e-4759-8b7c-6f883f8b85f0", "sighting_of_ref": "indicator--27a3aa7d-0dc6-4766-8738-61fd970139e2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e9c34f-ae6b-475a-b28b-092c2ba03916", "sighting_of_ref": "indicator--af59bb0e-9c69-4436-8964-406e8e241023", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4856c72-6dd6-4bf3-8673-a38f01fdaa41", "sighting_of_ref": "indicator--1b6b9606-b4db-4d37-9140-62a621d6a31b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1111f625-b400-4ff5-8b70-66d5978add20", "sighting_of_ref": "indicator--862c7d36-c40b-403d-8d7f-5dc71c0fcca1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--913e4d24-097b-4b17-872d-cd496cd2b54b", "sighting_of_ref": "indicator--5b03e2ad-b5dc-4ca2-b614-3e9b485fca73", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ad6f185-f5f0-4f25-8e05-c6c5596238bf", "sighting_of_ref": "indicator--f47a922a-916b-44c2-a510-a6e913ace3f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c223fbb1-2393-4551-bcb3-3ac8bb6e199b", "sighting_of_ref": "indicator--890ca897-2a2b-4421-a46a-40bc6483bfa3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fd8f861-de8f-4666-8274-fc766656c949", "sighting_of_ref": "indicator--65ea93cb-5cc9-4ce3-b2ee-4789e199cf9d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9222843-b2dd-48fe-b1a8-62424e1d737b", "sighting_of_ref": "indicator--a0807655-252f-4f2c-a6a2-18da114c7b52", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfd89b97-d98c-4e9f-b018-e5df8cbe9b87", "sighting_of_ref": "indicator--2dcb1266-7a94-4c76-94e9-a36da46cca39", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea46697-3454-455c-b319-95bf12bc40db", "sighting_of_ref": "indicator--c53182ba-758c-4372-9951-705fb44bcc9a", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c0dc4a6-f2e0-4574-84b0-5bc768202ada", "sighting_of_ref": "indicator--e9b42e05-b259-4521-b789-ff0336da77a8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4f6574-38dc-4966-b11b-3f02230164a6", "sighting_of_ref": "indicator--1d7cf08a-d40f-47db-b1e7-f9c0b2cc656d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7b0f43-0e40-4444-9ca0-774876ee1ca6", "sighting_of_ref": "indicator--8931ad2b-c927-46e9-b27b-375f4d008523", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39a9fc36-502d-42b0-9206-816da6300b8c", "sighting_of_ref": "indicator--220b97c6-50ac-4b06-95ea-4df5b2390c54", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74af58cb-0e7d-4b9d-bed1-1fc24b476f0d", "sighting_of_ref": "indicator--d745130e-6832-4171-8fad-2a5ea3a68bd7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaeed241-19fb-4888-af06-8b0db720be54", "sighting_of_ref": "indicator--0144e32c-e910-4aea-9a72-1eab5be5ebf4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be87cf67-ec25-44b5-8b28-c4f547565496", "sighting_of_ref": "indicator--c9406fec-60e6-46fb-92cb-b647fdc7e477", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b9e6b6b-a41f-45f9-a91b-f8086f6d76f5", "sighting_of_ref": "indicator--e74be9d3-3c5f-490f-8a16-bc1fd7ea170a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--206f15e2-2d2b-4cd2-9429-17d52df26d8b", "sighting_of_ref": "indicator--e0d6b285-3588-483d-addd-4a0713a66b1d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc7ba133-29da-477f-ad7e-940cad3e8812", "sighting_of_ref": "indicator--976a0ee5-e51c-4778-bb46-7149ebdd68a2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e6f058e-8d3b-43b7-87a7-67f5223dda26", "sighting_of_ref": "indicator--3ae9acaf-17f2-469f-96f2-81f428c7cd46", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e293a7f-ea9c-4978-9f16-0e05468e6ca0", "sighting_of_ref": "indicator--0146485a-e310-4f7e-a0b0-678b0e7e7652", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d424216-853e-4989-b6c7-26c10e3d6645", "sighting_of_ref": "indicator--c82c2ec7-d6fb-4eea-9ceb-82f71238e02f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e7b47a-407b-43f7-9bb5-12a1ef85f547", "sighting_of_ref": "indicator--7faac5ca-5144-4ccd-91e4-4f85437b8b3a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f7a05fc-ed4f-4cb7-ac04-b11e19cdfccd", "sighting_of_ref": "indicator--09663dcb-8f4b-4db9-a9e6-67662664d654", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb222b3-8e5e-4ba8-b74a-656886516227", "sighting_of_ref": "indicator--2bc9068a-560b-4e0a-b890-06da68501f8e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70fe3c8f-876f-4ff9-9331-1b4e43ca6e2a", "sighting_of_ref": "indicator--55508f14-be2e-4765-9da7-2ffd378d41eb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89590ee2-d820-48f2-9e47-668f85c88c1f", "sighting_of_ref": "indicator--e55e45d9-c5ba-4c8d-9347-492db07d0d87", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17991988-c351-457e-890e-0cfff8b6bad3", "sighting_of_ref": "indicator--37e16594-52e2-4e13-9429-400b0bc7baf0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48b00cce-67ee-4ab7-9f69-dd49a1f761b1", "sighting_of_ref": "indicator--7792b341-0402-4d94-8aa3-876170175cb9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e4cca09-273a-49ee-8381-ae67afe8970b", "sighting_of_ref": "indicator--669306ef-1813-40ec-a8a1-5ba347070e8d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3108d6fd-e2ee-4e91-90b6-b655d121f0b6", "sighting_of_ref": "indicator--f3dd5097-f6d2-4d15-b2ca-7615dce7eb85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6ccf7e2-7e78-43e9-950b-72caa10a48ea", "sighting_of_ref": "indicator--3842423c-2a72-4685-986e-5199d17e52cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cb7bbf5-e30f-40a1-892f-4bf7229c84a6", "sighting_of_ref": "indicator--c1514fd4-da42-446e-87cb-c0e93b66d2a1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a405acbf-7b63-404a-836d-5580617be20a", "sighting_of_ref": "indicator--e58e2b52-d76e-408a-a710-c743817a166b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76061e4c-68f5-47a4-9738-9524781c84a3", "sighting_of_ref": "indicator--85b5866a-f4ba-4736-893d-7a9cb9fdd815", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--058b2019-a7ab-49bd-9255-05fac171274e", "sighting_of_ref": "indicator--8de2d2dc-7766-4bf3-8349-1abd72e54764", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6970d4c9-8255-4128-8642-04578f5ab258", "sighting_of_ref": "indicator--3adac008-16af-4c86-b71b-47ad7c0bea7b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63773822-2023-4397-b463-dac7f050f52b", "sighting_of_ref": "indicator--f0734bd6-020e-4c03-b084-541ba0f28f01", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7f14cf-00fc-446c-bef5-90cf77654c4f", "sighting_of_ref": "indicator--4b4b37f8-f325-4c64-b97c-5e4e3b1d66d0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca529446-6b69-4c52-9ea2-bb65f7810793", "sighting_of_ref": "indicator--9aca7553-e388-4dec-b1c0-43b3ed5500fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26461a4c-14ba-444b-8061-1ab85fd269a8", "sighting_of_ref": "indicator--d16720c9-6f2b-4cb6-82fe-d85935a28dca", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f70cbad-21f3-42b2-880b-7767baebb676", "sighting_of_ref": "indicator--a8b4a939-1a6b-45a7-86e0-9627712ede91", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bbb6538-260b-4451-8e90-66cec6118629", "sighting_of_ref": "indicator--6c32eb0f-2120-4a4e-9712-baea92c9139f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79bff8f2-eda9-43bf-8002-fb68009fbabe", "sighting_of_ref": "indicator--45dbbb93-32ba-46dd-ada8-dc060d436d7e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b611cbbd-78d7-4bfd-b24d-18d24ca3669b", "sighting_of_ref": "indicator--5bfedf1d-2f3d-41a0-9951-718e36016396", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3d55a83-54a6-4a81-94a0-3f7b141192a4", "sighting_of_ref": "indicator--7c60f288-ec92-49cb-a574-6f1e046c3f11", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--228164f9-50d5-49cc-9e85-e9e1f646ecb4", "sighting_of_ref": "indicator--e67ea558-9ddb-43ea-a071-662a6b420a72", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04fb2605-1626-4af1-ba29-705e28230a94", "sighting_of_ref": "indicator--8e113155-c626-407c-bc81-b28081686ac4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efda5a7d-6f26-431a-ad98-2116b2ae2209", "sighting_of_ref": "indicator--91a1a313-e771-4f36-b5cb-1905e388371c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a33f895-f924-42f4-a8d9-03a38e7b046c", "sighting_of_ref": "indicator--97021dfd-07a6-4486-882e-df0cadfb9b55", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f112067-f7f8-45ed-a25c-11412c4c9d41", "sighting_of_ref": "indicator--dec87313-07f8-45fc-9511-93c4446816de", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4ef8ef-b7d7-4a83-be12-5a5d8b049256", "sighting_of_ref": "indicator--88644532-db54-4065-b77c-3d63d8018368", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e384d7e7-9726-4294-88aa-c8e46b3a5391", "sighting_of_ref": "indicator--8c857bb0-82df-46ab-b6d1-2eacf7134f21", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34f417d1-49ad-44bf-98ae-20e188db5420", "sighting_of_ref": "indicator--a13bbe60-81dc-4ba5-87d7-df0cbbdf511a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dba0b787-e6e1-4794-8ea5-3262a9baac3e", "sighting_of_ref": "indicator--de492dc0-4e15-4430-a368-9c8be2ab55f2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--982b87a1-b917-45e4-b5dd-b8b4ffffae8c", "sighting_of_ref": "indicator--ce06b6be-404b-4564-b682-3dd003ff46be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4785550-a550-406a-8ba2-17e32e6cb2bc", "sighting_of_ref": "indicator--5ef7feeb-c0f9-43eb-a4b6-93a4898591d7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4010a72c-4af3-448d-8043-4a3de5d9041d", "sighting_of_ref": "indicator--1669a25f-55d3-4a2c-a80f-ee3e0615249a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25303e2e-b135-4995-b704-04cf79aa2208", "sighting_of_ref": "indicator--1b85b833-c7c4-429f-8577-94c5b37feb83", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72579b0-6bdc-428d-a98f-bdf604d03618", "sighting_of_ref": "indicator--77b90174-c9b6-400c-aade-5e7a3dfca21e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d20221ff-d35b-4b6f-b386-f7f9071ed18b", "sighting_of_ref": "indicator--b88c63e4-a83d-4865-9cb8-11b9cd3b28f5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7468ec4a-dd40-4f7b-a211-f29b408d48dd", "sighting_of_ref": "indicator--7eab23df-33de-431e-8b73-2b9ad0748bd5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d3d740-7b4b-4247-800e-e1e5f781f0e3", "sighting_of_ref": "indicator--cd6a1ddc-1fec-4994-bf1e-72d928c939be", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7de884d5-658f-4216-983a-07036857621f", "sighting_of_ref": "indicator--5e129be0-e99a-401d-9e69-1f04b68d3fda", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6efdc3dd-84be-4001-992c-b049a605579d", "sighting_of_ref": "indicator--47b31a03-0b52-43e2-9993-dfa77a33717f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac502234-e3f0-41b1-a2d4-039846fbcd07", "sighting_of_ref": "indicator--01636921-25ae-472a-883c-16a3c904024d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3179b139-53d9-4a2b-8ee1-7f43c49c8b8e", "sighting_of_ref": "indicator--69afad08-be19-4b7e-b23e-9bd7dd7713a0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf5c8f2e-c284-459d-b388-8c04a59b0919", "sighting_of_ref": "indicator--c4ff4e9f-63f5-4a16-9e04-3cae6862a2e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--180e6cc3-7543-4022-9af4-0a5020e9d6cc", "sighting_of_ref": "indicator--62055634-1c07-4dd4-a78a-7f75867be3fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57d10ef5-baf7-4ed7-a0a8-86061146d6d8", "sighting_of_ref": "indicator--781d8df5-978d-4e3e-8b14-9c5142809805", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5786c830-e97e-4b3b-b285-69dae24ff1a2", "sighting_of_ref": "indicator--8c1821b0-a5f7-4e49-9a97-d4dd07af7aba", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--594049e3-3b42-493e-8b76-7e86b02a294a", "sighting_of_ref": "indicator--9d88b6d3-2218-4cc2-b2bf-f48acab99594", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b1a413a-32de-4bee-9507-b9ca264df920", "sighting_of_ref": "indicator--550e0990-cf70-4175-8369-c645a018b76d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e61b4db3-ed13-40ce-9b71-ea5d5545636b", "sighting_of_ref": "indicator--140c8df2-a4d4-4267-b02d-b508f101b5c8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c46c504-2ba8-400d-96a6-ff831d2cf579", "sighting_of_ref": "indicator--794251c6-3925-4baa-b37e-d82d72c76889", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e8221ca-f474-4b7d-9cb9-70bc54521274", "sighting_of_ref": "indicator--df454bd7-292f-4c44-849b-1ee287f954cd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d25ff8f-4433-4ade-847b-35c533bfd696", "sighting_of_ref": "indicator--a252ccf5-2390-4720-97a2-afed129ab851", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e41017f-5a62-48d9-b910-a2e5b908a979", "sighting_of_ref": "indicator--0772b045-7e52-4487-9a8a-31812f0fbdfe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42d57450-4309-4d4f-a2e4-acc8e4e3dfc9", "sighting_of_ref": "indicator--af0a7553-302d-4c04-be3b-9055b9107324", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b6f1932-e65a-4f57-88f1-a76abbca3305", "sighting_of_ref": "indicator--47210d7d-c41a-4a7a-bf52-91ad144c3437", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dc75c34-df86-4e95-91aa-6191121d5f42", "sighting_of_ref": "indicator--a77fdbd5-b5d9-446b-abf5-34b14c523a80", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92745791-33ff-45f6-9abe-fcff89e0b4ce", "sighting_of_ref": "indicator--ff0492eb-70a1-42f5-b5e1-ff6d2d2410d3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a9828d8-bc87-4dbb-bd38-fac93e45d23d", "sighting_of_ref": "indicator--816a3c6b-ad68-4a76-bdd7-b1f783349049", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--344b9d21-d931-4732-99cc-a34d6bbcb1f5", "sighting_of_ref": "indicator--19dd8bf6-81f1-4795-9300-66ad5ff9ef5a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e812adcc-14de-4b08-b6aa-a683d6b3a13c", "sighting_of_ref": "indicator--8a88fa33-f29e-45eb-8885-c7e41108f14c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ef99842-d21d-4912-b7d8-eb04904d454a", "sighting_of_ref": "indicator--620b6d7e-7ac9-417e-a1c5-8f8427c133ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce2256e3-57b3-40e0-b78e-78305aa67c5b", "sighting_of_ref": "indicator--966b44db-9248-4973-af12-9b8665d2c1f5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22174915-841d-478b-85a0-85ce45b0c7fa", "sighting_of_ref": "indicator--fa6a5aeb-6df1-4375-9a99-c4fcfaa56b69", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7392585d-275e-4598-b25d-c7e0e219ed8a", "sighting_of_ref": "indicator--d8f738be-63cb-4def-97e7-e477cc3b46dc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--001e63cf-0535-496d-9bb0-87adba0c0bd4", "sighting_of_ref": "indicator--da7b3825-7568-4b52-929e-5b794a5fd6fb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b285e3b-f0d3-4273-a063-6cb90ad05858", "sighting_of_ref": "indicator--62f445b4-d214-4782-a4c5-627623adb108", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6590aa97-d544-4382-9459-4fa8407cd840", "sighting_of_ref": "indicator--c7072fa1-b43c-4a25-b110-ee5e313c7a72", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53c271df-6ab9-40e6-81f8-7b7ea6865e96", "sighting_of_ref": "indicator--4df6f7f4-099c-4242-b173-2e8c25fd20e9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3059651-4738-4e1f-bdfa-97b7f891123d", "sighting_of_ref": "indicator--f4d943a4-8ae8-47ab-9916-d26c342076a4", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ace883-ae83-4ec4-b735-fb28636c4ff4", "sighting_of_ref": "indicator--ad2f0113-e11b-4160-aced-2cc8938ce5e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fa92284-5d12-4534-b93f-ef6b83e2108c", "sighting_of_ref": "indicator--33697cbc-06e8-46d4-aaa0-2bdee4b091ac", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71240925-5aed-495a-97dc-57c123ace4dd", "sighting_of_ref": "indicator--e278b0ca-fa4e-40cf-beb1-0c964035dc74", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3d5240f-161d-408a-99b8-8569863d082e", "sighting_of_ref": "indicator--e1240397-969c-42e7-a9f9-a6f3bca08765", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03c2d666-301f-4ca6-afbd-999d571c94e0", "sighting_of_ref": "indicator--e5964635-3316-4471-8698-aab6128ed8ce", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d65a961-13c0-464d-9283-83759fc19f28", "sighting_of_ref": "indicator--7494a5eb-ab1c-49b2-9842-efdc15cbc6ad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d1d47b1-3f94-499d-90f6-a750af82326c", "sighting_of_ref": "indicator--d8d95763-a527-4fd0-a2c6-b50a01c64ff5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1157c8d-0632-4fda-93bf-6dc69482ed61", "sighting_of_ref": "indicator--c368a7b8-0563-4f21-8078-03352817a453", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93902db7-666c-46d6-ad4e-21ce16ab731d", "sighting_of_ref": "indicator--a0534add-59c1-45fc-800e-cdf25d758956", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab55d07e-30d8-4f00-9b96-3a96f2b61603", "sighting_of_ref": "indicator--f9510de6-92cb-4de0-aa0f-20de0c624ee7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f38dcf7d-57b7-4ff4-8de5-349aef084b9f", "sighting_of_ref": "indicator--64095ac7-79e2-4a95-a8dd-f813e194d922", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c3846f2-55c8-4fea-a6c2-6fb5e0ff032a", "sighting_of_ref": "indicator--1cf60e8f-176f-4a86-b926-62199522218e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8cc453b6-93c4-4b33-8525-91185e5bea76", "sighting_of_ref": "indicator--c52bc589-cdc8-4157-abbf-3f78cc3e98c2", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c0c2992-1438-463f-b005-30a0ed20325a", "sighting_of_ref": "indicator--c64ba8cb-b034-4128-93ac-c139663c4db5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--337d6ae4-ae4a-4225-bdd6-781c6d3b5f8d", "sighting_of_ref": "indicator--336bd8ab-ce08-43b5-8337-b7384c17964e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f3b54a6-8f38-455a-bee5-1c92f2563818", "sighting_of_ref": "indicator--37e1b5d5-20c9-492e-8a96-be3f39812e85", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62477731-13c0-479c-a3e2-db67fbc8b6ee", "sighting_of_ref": "indicator--81b4b028-2e02-430f-a606-a4b1fbe3906c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d917dd-777f-45e9-9bce-34eb9f769377", "sighting_of_ref": "indicator--a200dc04-f973-43b9-8a6d-0346c4e3df3b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--755d1ef4-993d-4cac-9046-56e5a779b296", "sighting_of_ref": "indicator--b18a2253-8b11-4965-af8a-f9af82af8b75", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a3fba80-8376-4109-a1ce-f1272c641d8c", "sighting_of_ref": "indicator--89a11a4c-2197-4410-ba5e-e09d296e3467", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d8e8060-bf1d-4c37-929e-d6ec5af08fe5", "sighting_of_ref": "indicator--bca47a05-c41a-4f0f-bbb7-e2600a2d91d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0ff596b-abc8-4235-be74-e2b6b9953fb3", "sighting_of_ref": "indicator--3389622a-7978-4015-a3fb-a0a95ea27661", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b6917f0-cca8-409d-8eec-2a713327e67e", "sighting_of_ref": "indicator--d165e815-083e-4065-962a-3cf81ece22cb", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d7e0ffd-8607-4080-a168-806151670f33", "sighting_of_ref": "indicator--d161d9a1-d7e5-44d2-896f-76e0729e477c", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f21dc152-8b17-4b08-8f2c-e859c42d22fb", "sighting_of_ref": "indicator--152c1ba1-d816-432f-96e1-26796397f6a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2330c626-d211-4c6f-90b5-0667dfaf3600", "sighting_of_ref": "indicator--f94ae6e4-1216-42b9-83d0-f8278619c6a9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4c43bc-b929-4054-8903-88d5d457c0f4", "sighting_of_ref": "indicator--dd34cddf-2e90-4fa4-a40b-8fb60766f86d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc8e8096-ea60-4582-9b8e-fe480a433304", "sighting_of_ref": "indicator--be14e7f8-b6b0-4b66-b1b4-edb90db76362", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a451786-497c-41f6-bf89-4010925708d8", "sighting_of_ref": "indicator--475c3d3e-2297-4195-bd0f-147e7eac34d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e4667e3-89e6-4098-bdcb-f2327147f52b", "sighting_of_ref": "indicator--ae9a8aa2-c32b-4ae0-a1f2-ea0c8b50e8e5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--909ddc91-e6b0-4c1a-b64d-24650118c4f4", "sighting_of_ref": "indicator--776ce16d-fc63-4cc2-896b-4fb925843f68", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93581d98-a15c-4f47-a585-0c0cf3f24790", "sighting_of_ref": "indicator--cca4b64e-9a4a-4ec7-93d0-cf8372d57645", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e722d73b-fbc0-48a5-a323-f53478e28ac7", "sighting_of_ref": "indicator--8d7e9961-bc50-4f23-928f-c1fc0d9f2bb8", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7212a203-d5d4-4c40-af05-3ea30dd6bfc4", "sighting_of_ref": "indicator--45cae49c-44fc-441e-80ef-234ed5a6e7dd", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cad846b-ed36-40fa-af58-844a28688028", "sighting_of_ref": "indicator--81f5a674-dbaa-43a4-808c-3b0953cec07e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4325c15-7703-4d25-9644-6d1025236922", "sighting_of_ref": "indicator--5fee21eb-3ac1-4e71-a62b-14fe0d664293", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e96b252-a584-457d-84d1-b456b059789e", "sighting_of_ref": "indicator--c42a92a3-24ab-4042-a321-a70245af6bbe", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8ad1a0c-8956-41fc-9bf8-a627b06162b9", "sighting_of_ref": "indicator--acf37171-7728-460b-a89a-53a1780c3628", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d15241f4-9eba-4182-9363-f336f866d4b4", "sighting_of_ref": "indicator--e37090c3-3383-4501-996a-54b5de35344d", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8a0be0c-0294-44f4-9654-786c44027168", "sighting_of_ref": "indicator--e64cd160-1bdf-4c7e-9220-8093e16bad23", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--393eff3f-3d7d-4708-9fab-b742a3bdd171", "sighting_of_ref": "indicator--f34477fd-a28a-483e-8ff8-0efb4a6ce749", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c9b790d-9ed7-4d25-8f66-3df1d2943ed7", "sighting_of_ref": "indicator--48a3454e-6414-4c2e-8e30-99b22288769a", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fab9ffaa-4205-4fba-812d-1b22c60a9828", "sighting_of_ref": "indicator--bad44a34-1451-498f-97b6-1e640f85183e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd851db5-a0ac-4d32-8b17-27f5f576898c", "sighting_of_ref": "indicator--82bc86e1-5671-477f-b4d0-1e20eeed2604", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--410d80a9-5e6e-4c6e-b98b-5f8a32337e4f", "sighting_of_ref": "indicator--9be8822a-9d73-4ebe-80db-7ca104630450", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf698ee2-2bb4-44df-b418-e74d34a0cd70", "sighting_of_ref": "indicator--d79e5627-a9f6-4843-adb9-b7f6fda430a5", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--519e34d1-84b4-42c1-b7d2-8c20c385c742", "sighting_of_ref": "indicator--9cb29638-bbc1-4936-bb6e-aae902bdebf0", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e56819e2-640f-48e1-bcf2-d564332650f4", "sighting_of_ref": "indicator--97f610d5-04ca-4115-bd6a-a4c09f57a4a6", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89a02b17-22d7-4a82-8c28-fc3e5d26df27", "sighting_of_ref": "indicator--099dc12f-ab4c-4f40-a073-958b88556c61", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1fd9230-92fa-447d-88af-dabe4167d6ed", "sighting_of_ref": "indicator--d5e4df6e-032d-4f81-9892-1d094c837244", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--808127b2-e3e8-4107-84ae-3ba20ce0b6cf", "sighting_of_ref": "indicator--dbb09b8c-0d10-40e6-abec-08cb9a5cdf1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28ddaf05-c360-4169-8b1d-afd8532c7a95", "sighting_of_ref": "indicator--f2552f31-19df-47d1-a8a9-a10ba840a0fc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc62f959-dafa-49ea-9953-249fb304afd7", "sighting_of_ref": "indicator--373cbbd4-04c1-451b-83c4-27480b7dcc7b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28cdbab0-6b09-4e0c-81d3-47556c66d3fc", "sighting_of_ref": "indicator--373cbbd4-04c1-451b-83c4-27480b7dcc7b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6c7850c-f537-4867-805f-236c87031ebb", "sighting_of_ref": "indicator--59f41f11-c78d-4629-938f-1591a6f06602", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e9eb862-9b81-470a-9cdd-e306b948bb3a", "sighting_of_ref": "indicator--0b9f3ee4-c8df-41cc-8b5a-1407c9f91970", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da8b5fa4-38f3-4f76-8a45-48e7bcc75bc0", "sighting_of_ref": "indicator--d3a779f9-419d-4d2f-a4db-91215e110b7f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72a52df2-b53e-4844-82d9-512aa302ed18", "sighting_of_ref": "indicator--c970c8ae-8de0-4f3c-8632-784bc4c79426", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d304c294-042e-4206-9251-cfd5f32bb17b", "sighting_of_ref": "indicator--88fe9d36-b749-498d-8607-74d0a9f0f8c3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3e4aa52-9edc-4c0e-adfe-466e557f2eb1", "sighting_of_ref": "indicator--88fe9d36-b749-498d-8607-74d0a9f0f8c3", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d48653-cb4c-4860-8102-8826fea38a59", "sighting_of_ref": "indicator--ca24c776-4e0b-48d9-a432-eeec5b2ae42e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a17b8da-4490-4799-a565-e644f4c22f80", "sighting_of_ref": "indicator--16580715-c702-4f5a-ab44-19e7bd793d40", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b287966-67fd-4dc6-9394-366e2591ed6e", "sighting_of_ref": "indicator--57f049a1-2209-4795-b128-3e16d6a58d2e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d90ea73c-3bb8-40f0-9bfa-077af6575e31", "sighting_of_ref": "indicator--e1f1e3f0-0738-4ac8-beb3-698aab889000", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6bbe919-c9a7-4f54-abf2-6d653b224be8", "sighting_of_ref": "indicator--5889fb02-642b-4c71-b661-e9d9f2bf1f58", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02398fda-e56e-4643-af7a-005a5cb98d86", "sighting_of_ref": "indicator--70a194ed-8a6f-48c3-ae01-2f4dc803fe5e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80428bc2-41bd-4f2b-98c0-2a0cefb973b5", "sighting_of_ref": "indicator--d23a87be-24c2-4d28-a640-a680ec15e178", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--193082b3-0e6b-4adf-826a-6c58354e7d07", "sighting_of_ref": "indicator--18e0ff5c-e78f-470f-affa-c57c4dab59e1", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af405500-fe1c-4be1-b855-97db23eb4712", "sighting_of_ref": "indicator--97f7a984-31a8-4e4c-b22a-e32344954e6e", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86387bf-c448-4239-b50c-64d55f016ace", "sighting_of_ref": "indicator--002f69a3-e4a1-481a-a4f3-dc56e79b6bdc", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba60f476-62b7-437c-a080-3ede321e94ce", "sighting_of_ref": "indicator--a6b68bc7-5662-4eac-bae2-15049e24f677", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82b9ba3f-2c8e-47b9-977d-06d2156ba6f2", "sighting_of_ref": "indicator--738f6083-a95c-4b17-9ba4-782b5e021a22", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19757f5-4523-44d3-9894-7abd800b3a62", "sighting_of_ref": "indicator--5cc3143e-8ee8-42b8-804f-fce0d8248588", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1637392e-b3e5-40bd-aa36-507673964785", "sighting_of_ref": "indicator--ff17139f-27a5-4a21-bb63-95a13413bc1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1274ec65-0c55-459b-aa56-af62cfb6c5b5", "sighting_of_ref": "indicator--8956df17-1c80-4202-92cb-0aacfa56ecad", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7aea4a03-63f6-47d6-883d-b31fbac777f7", "sighting_of_ref": "indicator--3c2de1e3-ab93-4226-a87f-c22b6d25a515", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64d365b8-c3b6-4592-874b-05bc1232da9f", "sighting_of_ref": "indicator--8ec38c0d-3df4-443c-8249-89978360a7e7", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d089a36-9a04-4088-b4e7-cf5b20dd92f6", "sighting_of_ref": "indicator--e2fd70ee-07ef-4b77-a7e2-827679029dd3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c15c6692-6600-4a76-a477-5df166f9eaa5", "sighting_of_ref": "indicator--b6ad152d-6893-47f8-ad2e-e6a317b524d9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df75513d-d055-44f6-83d2-5df6e5c7a206", "sighting_of_ref": "indicator--0fddcc04-1f11-4475-8c57-9e7ccbb82d0b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cea82b50-1e22-45fd-b472-31e65608e39c", "sighting_of_ref": "indicator--0fddcc04-1f11-4475-8c57-9e7ccbb82d0b", "where_sighted_refs": ["location--8e917b74-d922-475e-83a4-4dd070957185"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310332d4-92ad-4314-8f35-e7fc4ced6f63", "sighting_of_ref": "indicator--0fddcc04-1f11-4475-8c57-9e7ccbb82d0b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a9d31997-10a3-400b-94c7-6aeb54e57560", "sighting_of_ref": "indicator--d1c5005f-f66f-4af6-995b-b0a67504c2db", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1389c7be-1e90-4513-b8a4-ae8d209a8bd4", "sighting_of_ref": "indicator--090d586f-fd64-4a93-bd4d-05829dd35732", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62d40897-bd91-4032-9525-b3d89f571985", "sighting_of_ref": "indicator--17b8d76f-6cb0-48d2-8e2c-e5b80372157f", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35a58938-ed28-40fa-902b-f5e25502137c", "sighting_of_ref": "indicator--3f9c715c-420c-45ea-9f00-3a0c08392bb3", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29728d1c-e0e9-4791-a60e-0395ebefc484", "sighting_of_ref": "indicator--8ac0a558-ec6f-4dd2-8035-4e7312ca8b9b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3493af42-75da-4776-8207-43e9e73774a5", "sighting_of_ref": "indicator--ec93b908-d0b7-4262-b492-d4f691be119f", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4446bcda-3ae3-4320-ad94-124d190109db", "sighting_of_ref": "indicator--098ddd02-b0a4-4539-8c44-88f712b04d1b", "where_sighted_refs": ["location--26d62335-a589-46f2-90fe-b2f4122ff7a4"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6417c215-c6b8-4629-9663-b5307e24eecb", "sighting_of_ref": "indicator--4d426f7b-c3f2-4517-bbbe-e895fd96216b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66dc6ec4-5dcd-4a56-8e6f-f0ee085dff2b", "sighting_of_ref": "indicator--83b6e7d7-577b-4bd9-86a5-13a000066c1b", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fea3257-2c25-46ad-891c-64631bd7654b", "sighting_of_ref": "indicator--6e842171-7066-45d2-a163-e33bb282befa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93becf8b-f9a4-490e-98b0-f6743e6297c4", "sighting_of_ref": "indicator--83469504-197c-484a-a749-3461434974aa", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d63bb70-c90d-43ef-b32d-f804b8d7738d", "sighting_of_ref": "indicator--19698c72-52bd-425a-b973-cc801b61dde9", "where_sighted_refs": ["location--42c5af1d-44da-402f-a38a-19e8a63336ab"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4df0594d-f87a-4ab5-88e9-1a677ac263eb", "sighting_of_ref": "indicator--bbce3109-a41a-4a8d-a953-14f852934648", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78c2dd85-d961-40b5-ae2c-89dda6756a98", "sighting_of_ref": "indicator--9fa0b587-9c7a-4a64-8d0c-a5d7ab5764fe", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64043acd-aa12-4271-9a5e-d9617f158278", "sighting_of_ref": "indicator--ba03489d-20b2-484e-8b4a-0663bce34149", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b00919-f61d-45f0-8ba3-e788ad0bf172", "sighting_of_ref": "indicator--92f8d45c-6d5e-4f2e-b2bd-495d183b435c", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20e4d931-c535-409a-913d-0a4f56307496", "sighting_of_ref": "indicator--f6ec4f07-2ab0-4d6f-96a2-21854bbd4660", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62150658-c422-4472-83b9-3ae2f04b22c5", "sighting_of_ref": "indicator--e7219759-202c-43f3-a132-c99b5a7fc07a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--676b5fe4-42e2-413d-94b2-4f5ef758a956", "sighting_of_ref": "indicator--c79e21e5-d8d7-4ba5-b256-5f1a2cf376f3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f2968d-46f4-41d9-a206-9a682939435c", "sighting_of_ref": "indicator--13a23f91-ea12-4aec-aa24-e54732a4ebb6", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd77efe-33f3-4c3b-a7d7-3d265fc36432", "sighting_of_ref": "indicator--e3d879b2-0d5d-4f2c-b253-54d3211070b5", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d3f5dd-6796-4f18-baee-039f14eebe56", "sighting_of_ref": "indicator--363bce6b-cd6f-47b4-a8a7-32cf9b7c319d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cc4ce95-1d4f-4b8a-9c6e-18ea6358e95b", "sighting_of_ref": "indicator--3c02bdd0-e067-4cf5-9327-c6a620686870", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--780daed0-8275-4838-9f0a-8ded97f24261", "sighting_of_ref": "indicator--a01d2fb8-cc57-40ac-9efd-06cd0b475516", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ca1168-06b8-460e-8147-455c023e2402", "sighting_of_ref": "indicator--ad23784d-ffc9-4013-ae9d-0cf77583de90", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70129fd9-6a18-4531-a961-abf93da67335", "sighting_of_ref": "indicator--1799f41e-116e-493f-b380-f3f3a46f31e6", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d4b7a61-841f-471d-8211-9746598c968b", "sighting_of_ref": "indicator--fcbdf101-6cc4-4aba-acbb-bae089f6b5ba", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1f95480-b273-4454-8f41-b7eb98f19a29", "sighting_of_ref": "indicator--734543cc-7e41-4699-9077-f2cea762b45a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0d58892-59ed-4697-8660-d398c6e2677b", "sighting_of_ref": "indicator--3a7ace18-ce41-4fc8-a293-e26dab3149d3", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e2bd24e-9ce2-4765-8f10-c93744221777", "sighting_of_ref": "indicator--7073f220-0a6b-4c11-833a-d02c0bd98c85", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b95c3390-06d2-451d-8fd0-66f194b9faaa", "sighting_of_ref": "indicator--3b19b4b1-48d5-45d9-8eb3-7c9c641fd29d", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5628b0bc-aab8-482d-8c38-0b3f27cc97d2", "sighting_of_ref": "indicator--cee7287e-36e6-4a56-8d95-e3d9256e5351", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0189d3d1-c1cc-4722-bb36-3abd7c6551d6", "sighting_of_ref": "indicator--bdc2862a-ef62-44ff-a4b7-87a191154deb", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d2cf2db-02a2-41c7-80c3-9699d023c53a", "sighting_of_ref": "indicator--99d0410b-745b-466f-a838-9400fc4dd79b", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4ed3eec-2e3c-4166-a335-abdaab282b62", "sighting_of_ref": "indicator--17af088d-b1e9-4fcd-a1c4-5ed09e24373e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac90c142-509b-436c-9496-207f6f814613", "sighting_of_ref": "indicator--4cd4def1-8272-4d52-8899-184789aed123", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a37a259-10bb-409e-8dde-620b4dddb341", "sighting_of_ref": "indicator--20c92e52-f9fb-4ecb-bcbf-64e36f377c6a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f16a1154-d6fa-430b-9ff4-dd50482d6bc5", "sighting_of_ref": "indicator--18987098-a7f4-4cb5-b60c-dcbf7a9642b0", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e16769-5b8f-4313-93da-05bdffcdae58", "sighting_of_ref": "indicator--e2d281a3-3e26-4c11-a521-7ae8f90ad588", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbbed88d-b9df-4ff0-b86e-4ba20c6c702c", "sighting_of_ref": "indicator--d18c28e1-d3c2-47b9-8ede-af1bdf051aef", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ad1201-4628-476c-8e6e-762f0a422990", "sighting_of_ref": "indicator--cdd3e739-1440-4ad8-837d-6378a2794dbb", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eeb19fb-0461-4f1e-97ed-8cb543c17914", "sighting_of_ref": "indicator--2c7a9536-a445-4eb1-b982-d9673a3b85b2", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--367a52ee-276b-4737-b63a-44a31ec91fb5", "sighting_of_ref": "indicator--f41d20ed-0b32-4f7a-9da5-bcd4cd986904", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2631fb47-59b5-4677-9292-9ae94d522e7f", "sighting_of_ref": "indicator--dacd9b8c-a3a4-4574-9938-c702d56ba22f", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f895aaa-b560-4a38-ba4c-e6d057acc8f5", "sighting_of_ref": "indicator--ad433d92-7c53-4b3c-b8ad-2de75695fbeb", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91bc4c30-cc13-470a-86bd-d5190f3e78a3", "sighting_of_ref": "indicator--fa802972-6c82-4589-8a52-98a7262bda5a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--055e0cf4-7332-4ce5-a891-915318b7dbd9", "sighting_of_ref": "indicator--610aa701-0dd9-4c15-a1e7-9642fed6a1e8", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a356c1d-11ac-4515-8624-860c26a228f4", "sighting_of_ref": "indicator--49f3cb52-9315-4ef4-b89e-b8ffd961c60e", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f66e419c-aea1-46b2-a6ae-e8f738c685d3", "sighting_of_ref": "indicator--0391e3f8-1569-4e6c-b3a6-cfc1863e174a", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a96352b5-69c2-46d0-83c4-855cc1ff2eef", "sighting_of_ref": "indicator--f3627692-57b6-42c7-9850-e62e255f05fb", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0f42ff1-667b-4ef6-ba84-e12ccfb2261f", "sighting_of_ref": "indicator--bd7208df-3809-40ef-80db-b70645d645de", "where_sighted_refs": ["location--ff5c947a-d0d9-4ceb-961e-e39660c8927b"], "first_seen": "2026-05-27T00:00:00.000Z", "last_seen": "2026-05-27T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--9773aa86-9d29-4427-8e1a-f370ce067775", "name": "Threat Report for 2026-05-27", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-05-28T11:00:02.453Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--ff5c947a-d0d9-4ceb-961e-e39660c8927b", "location--8e917b74-d922-475e-83a4-4dd070957185", "location--42c5af1d-44da-402f-a38a-19e8a63336ab", "location--26d62335-a589-46f2-90fe-b2f4122ff7a4", "infrastructure--81f40b9f-fdda-4c1c-8a62-7b5989d7befc", "infrastructure--973cb92f-bffc-4a33-8140-77740499f657", "relationship--64957529-1521-4659-a7c9-956a03aca469", "infrastructure--b501643e-da80-426e-a72a-91f70b2bb930", "relationship--fcacf5a6-a06e-4bc7-a965-82b74c9ff321", "infrastructure--0d0ef221-971e-4b12-9c69-eadca6b0025f", "infrastructure--0d2f7eff-fed9-494b-bd97-deaa04b8c71a", "relationship--6365f841-5b4f-4d52-b2e2-2f1aa9c203b9", "infrastructure--64aa4826-33d8-4ef9-a34c-9b2e366f4aee", "relationship--504bf07f-acb4-48d6-84eb-53f6cef9016b", "vulnerability--a6c040ac-6f84-4fdb-8d15-d4cc1d790d41", "vulnerability--e77df12b-61de-46b9-8f9b-1865b3947d37", "indicator--cc093854-7f7e-4c52-baef-01db96f2549e", "indicator--4c61e1e4-a02d-48d1-b76f-40b4a1410bee", "indicator--2e913fe2-6f1b-4d16-a898-6834859b38cc", "indicator--91d14aee-87f8-4808-b18a-4e2a8d0705f7", "indicator--aff757ef-6429-4aa3-81cc-aadffeb52376", "indicator--62197380-5f67-4039-9626-bd80f711bd2e", "indicator--a5698bfd-4cdc-42ad-93da-8188e67fd9c9", "indicator--d6c9ccaa-3773-4077-9f9d-1f797ca45553", "indicator--9ce65315-0713-4f65-8214-918a868806c5", "indicator--863609dc-1bcf-472d-838d-4d67155ec519", "indicator--497331b6-1054-4ca6-83f8-c5275f467d7d", "indicator--24e603e3-bfb8-41c1-9ee0-fd182d37218c", "indicator--3211e8b1-f546-4e71-9abc-9cc915d39055", "indicator--381a84c4-d215-4833-aab7-501874e7e855", "indicator--fc7cb96b-3820-4d77-98df-32b6d5d87318", "indicator--c058d9b1-0e5d-4c42-9b59-492b0e00c813", "indicator--cb4df340-4545-499b-b31a-5d6ad1d38c2a", "indicator--8f80a632-216c-4d57-ad8b-0997d9f9d5b4", "indicator--fff33c3e-6ee9-40bd-9710-c9dd3dc130c3", "indicator--79b8be35-ccce-40d1-8db3-2cac92cdda74", "indicator--6858474c-a3f8-458b-9d37-b1a690d09e14", "indicator--0d98a78d-1c0e-4e2b-a3f3-923bf5844914", "indicator--e2bb063b-8f44-4482-bfd3-e3ea973c498c", "indicator--a4cec838-8fa5-44ca-a401-b6d48ede7af1", "indicator--da5d2319-b6c1-499b-9063-e010afd2bb9b", "indicator--566f79e3-5a1c-449d-af61-76b96d64b2f0", "indicator--31773f2f-d952-4553-bb2f-71f9ce1ccddd", "indicator--4da7e822-3ed0-4aee-9119-66e9f6466a01", "indicator--1fe071c1-6026-433f-bd6b-4a7577cbb2f9", "indicator--bc358ddc-8377-4a30-b4d9-a81a55e109d3", "indicator--59e0edc0-2a1f-4d3d-bf32-87d373189039", "indicator--19e53345-f5a6-4d1c-81fa-070ec22c211c", "indicator--2d57a9d5-bbbb-4cdf-b93a-8b58ff1435ad", "indicator--a294924b-e032-48f9-9423-c4e94b9fbd64", "indicator--0ffc20a1-5645-4c76-bf82-72f65037b714", "indicator--5ea99784-41d6-458c-b001-f491b3b050e4", "indicator--fc3619cc-a05d-4e9f-9953-481a32ee26b9", "indicator--49202eec-fe03-4c05-bf3e-68e0c531cd45", "indicator--25f325ec-2fde-40b1-bd0a-8150035c7c46", "indicator--4746e59b-e480-4286-8176-9addc70227ae", "indicator--267304db-df16-405c-a79e-75afdb24a23d", "indicator--9cec5188-a635-4c18-a162-6ff023b9ebc7", "indicator--f5634d5a-7991-4767-b502-893cac123863", "indicator--5ceff63b-1b87-48e1-bf76-694b47e4414d", "indicator--6db01549-953f-4b73-a76b-6eccb074cac5", "indicator--7606a0ab-ebc0-45ae-a4c8-6edf74c4dcd7", "indicator--e428cd5d-a207-4103-a70b-b1781c2e63f8", "indicator--e03cd791-b158-4e13-86a2-d8670c6ea56c", "indicator--68c77dcd-f7e4-46f1-9a5a-2af925fb5e8f", "indicator--076d5227-4172-41ea-ac4b-940b72270546", "indicator--1c751457-bec9-4b12-8014-6bfb408682fb", "indicator--f77052d8-5849-4c41-8fa7-e53b7567e1fc", "indicator--06483a39-ffcb-48e2-9ef8-3758c23b5ee7", "indicator--7add1621-ca5a-4c36-853a-e472537ade5d", "indicator--1429797e-1700-480e-93c8-1d155c0c5c8a", "indicator--a44638c5-8c1e-4ff6-a48f-dfb3f2875bf4", "indicator--e11fdd77-998d-49ae-b876-6fa59f0cea5e", "indicator--c9f7c9ef-0fdd-4122-a15b-7c1aa0e9f56e", "indicator--63d33ba6-86e3-44ce-b83d-0ad472ab69cb", "indicator--0dba35d7-76e8-4f17-9743-877251ce880a", "indicator--341c70ac-2d36-47a8-9ed2-ed156296b24f", "indicator--58f848cf-b7ef-4ed7-98fb-c7d1d990d304", "indicator--827935f0-9323-4912-9a82-30531fef00f9", "indicator--1136bad1-65a9-4aa6-8bd0-672f93b2c670", "indicator--29f3a483-199b-43bc-a289-5f46f165ed68", "indicator--6441dab2-5a2c-4b14-afdd-ece56fce605e", "indicator--3eaf2d1c-fcaf-44c2-a0ca-12de65f9b869", "indicator--fa63467e-e49c-4e74-b023-cecfc4303501", "indicator--03aa641f-8f65-402f-b3d2-dc92757fef67", "indicator--01ff88ec-0b5a-4ec6-a5ab-194a583ec5c2", "indicator--0e1dbca7-9c8b-4080-b539-38567cb02bb7", "indicator--fa8f5aa3-5bd7-49d6-977f-e800f02c4c2c", "indicator--6b2db0ee-0d6c-4911-b93c-f6dee6e1f940", "indicator--b41c366f-6fdc-41af-aa32-b372d73b06c6", "indicator--f6731015-d5ad-4109-b2d2-df04a19987e8", "indicator--aea3364a-0664-4e41-a848-3600b575a392", "indicator--4d4f9fca-95df-4c6d-a716-116f14754352", "indicator--233468c5-8249-4e1d-b745-b6bb47c7026a", "indicator--0a0c123b-0da5-46d3-baa4-4c036d250a55", "indicator--56ceb7b1-87e9-45bc-85b5-7f70e11867c0", "indicator--4451e090-0cb1-4f38-bff7-3eca47acce26", "indicator--96c6068b-aba8-43f8-bd92-120e17fb6289", "indicator--ac47798e-386b-4cb1-bff7-efdb609f9459", "indicator--bb29213c-08d9-43e1-b892-173f4b88ee7d", "indicator--6937b36a-bed3-4570-a226-d770431a5611", "indicator--5a4a7d8f-b8d9-4f3b-843b-bc9e3396765e", "indicator--95ecf8f6-e4de-4986-b9e1-f5f1ed04bbec", "indicator--0a3087cd-2d83-44d4-a05d-9a38e7460088", "indicator--3716389d-1bf6-4da3-8926-58f650371c2e", "indicator--24257e58-9843-4aff-9f7b-1041885df4d0", "indicator--0a2734db-0db6-4ad9-97f2-0f1973bfdec0", "indicator--68ab36f8-0a8c-42ac-8e18-a8dd4c727b9f", "indicator--6f391d24-a498-4d93-9550-d11b05cebbbc", "indicator--6c52a63e-2ea2-4a79-a1d2-05b7a896ec76", "indicator--08caf020-4742-4835-9231-0183315066f9", "indicator--643d77c1-70e4-4203-9433-8a7e0b772c21", "indicator--4ac32509-5fbb-4663-9ace-eea40a9cdb86", "indicator--d599394d-ca66-4605-8bf8-c177bcc69aef", "indicator--71b06a27-ca53-4b0b-9bf6-882073b68a66", "indicator--05e2c381-af24-4c1a-9b26-3da4a4b2c06d", "indicator--db91773c-a80b-4036-89c1-2fc6d223011e", "indicator--99a89027-8d87-427d-869e-5ade429e6e64", "indicator--d41f6c5d-4b43-4022-b1c4-0689a84671f2", "indicator--0dcf7302-ffbb-4567-8962-f3c066a408b4", "indicator--ec5013b0-ee37-46fa-b735-737dc4e3af28", "indicator--6b43bfc6-8dee-4896-9f20-115ce698e50e", "indicator--1f6ac1c5-9fda-4af8-a1f9-1c6410e69c0b", "indicator--fb56654a-3e5b-42c8-942f-83722eb845e9", "indicator--7f9e02e3-98ff-44fe-b489-ecf05f9d13fd", "indicator--3efee99e-101a-467a-abe9-2a7571b85151", "indicator--39a1d8c1-553d-4f64-b5a1-f1d8ed0b0e88", "indicator--00ebbf09-a1ad-4b8b-8bb1-d5c74d9a86ad", "indicator--1e9f6a35-91be-4166-937b-6813355d27df", "indicator--9952bc90-77ef-4088-bef6-6dde1cc2919d", "indicator--5160b2f4-fbef-4ba1-ae0a-30001166c22a", "indicator--bb6a1df4-949b-4240-84da-22a365af2aba", "indicator--9a2d69c0-4ac4-4177-9f81-4e112dc9d475", "indicator--90474ea6-db42-4a1f-ba61-6e5ec2ab15f7", "indicator--a4edc966-a323-4fe4-9f54-099d98bfecb7", "indicator--70a221a6-7867-4fd3-95f2-8017d1b1af51", "indicator--9df11101-4189-4971-97ab-9e720a70e485", "indicator--cced9428-85e0-44e4-8ee6-744c8764eb42", "indicator--ddec59f4-524a-47e7-abf6-ca6c8e7349dd", "indicator--8d6f8488-69b3-4c6d-a4db-0edd6e618428", "indicator--a123d31d-8010-496a-9dba-72fbb256f06f", "indicator--1ae651be-f122-4227-b888-ec1082d9c61f", "indicator--ca22f191-883b-4d3d-a66f-0467e702c356", "indicator--ec0fb121-19e3-4777-8615-a655a02b92c3", "indicator--cdffc907-d0a5-43f6-8fe1-c4e454762e58", "indicator--24351e21-f92f-424b-ba92-da13c0886c09", "indicator--7f0fed7b-445c-4b87-90a2-5b56069468dc", "indicator--0e5901d2-4d69-4548-b8eb-c2b1caba0cbd", "indicator--eda76c85-7fa8-4389-bca4-b26c93922998", "indicator--622aa0e6-1890-44f5-bda6-0dd02c550d5a", "indicator--37b20257-fffe-4b5e-8dcc-18175b40df6d", "indicator--4da37ecf-65de-4950-85e0-c71e44d1f5e1", "indicator--e5913ad4-f3f3-4d6b-bfe2-d8f79e964b57", "indicator--6a2749b6-dfe6-4b62-90cb-48e39550c762", "indicator--921dc3e3-40d4-4c34-9806-a80cfd43d912", "indicator--1bafb4b5-1fe2-49b9-8e12-4d79dc57c44b", "indicator--0a314548-8513-4835-a8a0-79f2add9f229", "indicator--1edeeddb-457a-4a2f-93c6-45250e09bd03", "indicator--228166fa-de1e-43ce-8125-a459f6bbcff6", "indicator--780b9e8e-2f46-48b9-a68a-fc709b71b8e1", "indicator--95df311a-9dff-4617-8232-983811fea1e5", "indicator--07ad1613-bfa8-44c7-8462-b597c5aee614", "indicator--cdaba7a8-2370-4bee-9ab1-c8bf1222d075", "indicator--28e7e76d-50c4-4ef0-8ecf-2f9f811f580f", "indicator--74049a0a-4791-4ad8-a801-799f83384031", "indicator--8fe3c00e-56e5-4909-9e08-fc6ec941c311", "indicator--c72a3cd1-34ad-473c-baae-4b4fbf589cec", "indicator--ecd9e09a-726f-47d4-a23f-7b6f4aebc4ad", "indicator--5fe3d417-c73b-4cd7-9456-fb812cee64ba", "indicator--2595497d-3273-41ea-a43d-894247ca45e8", "indicator--d7eb91c7-88ed-4279-b422-46b2c93ddf47", "indicator--b82125ae-df0e-4771-9f68-bae27e577dc9", "indicator--09dab221-2e6e-42a9-900d-e0d13a4f34c3", "indicator--4a9fa29b-4e9a-4ecc-ae16-31e92144d1b2", "indicator--06f34284-010d-47eb-b869-71e51ca86800", "indicator--c496ee9c-e242-4446-a9fb-f065136339dd", "indicator--f6e69293-bf93-49b5-9057-c24ef501a6e5", "indicator--b48fc40c-2623-4238-ae79-328241e1f52b", "indicator--a14d74bf-ccc2-41d2-aa7d-7347eadd8993", "indicator--bfc2ec01-a534-4c8e-b2bb-32e3445aa24d", "indicator--24e18c86-c9b9-400c-984c-e24ca59ebf9a", "indicator--96abbaec-aef4-4465-913c-3511bef8aa0a", "indicator--d2022dd3-5e88-4967-8108-4d7fd677f7c6", "indicator--0aa81ccc-1209-4d82-b857-8d114f787005", "indicator--3adbfc29-3e49-4db9-af18-44c6b89b96a9", "indicator--f893babc-2b2c-497f-800f-9d4d03ea6f74", "indicator--38540658-55c4-4a80-ace6-789cd8e42146", "indicator--4ef7334e-8e59-4912-bb3b-b7a6b42c50cb", "indicator--08202778-a65e-4ec1-861d-4224682282ef", "indicator--0b10e6f8-0d7a-462c-ab82-83acfb46256c", "indicator--ce8bf491-c406-4664-860f-5e537e917f6f", "indicator--4826fa5e-84a6-42ed-b732-f55f507cdcf3", "indicator--bb5fd47f-d574-41db-973e-d55f50f13d23", "indicator--03d09f57-dbf2-450b-900d-fa087beb15c0", "indicator--4a2b157d-ab70-4068-a13b-ad7c2cdb7ae7", "indicator--b56bc350-1c82-4356-a570-70cb68c98764", "indicator--e2f69f15-f6a2-41a3-b207-387202fadd33", "indicator--de4fee66-ca45-482e-8c9c-9d470666936b", "indicator--ea19aed1-e327-484e-bf54-21c5b547e44e", "indicator--319fb87f-572e-49c3-8c2f-0f3a04043481", "indicator--de0b3804-f3d0-49d9-ab8c-30e5de2256d6", "indicator--bccb6c23-351e-428d-8f91-79e613f5e4b1", "indicator--db997af2-aa8f-475e-bace-7e95b18651f5", "indicator--0b772cc0-8452-41c7-96b0-fe03b8fb1804", "indicator--c4bba1c0-331f-42ac-97af-3f5741496e7a", "indicator--757e7bb6-1fe9-49db-97a3-283e8ff8e38b", "indicator--6405f366-07fd-4c56-a0a1-1d4d051d1ac9", "indicator--46538332-69c7-423b-9e70-c87b7acf4363", "indicator--de60d594-ec27-4379-a434-840e144a2a79", "indicator--933e89ef-ec5f-4fe1-88c6-a5a389a527d2", "indicator--16211ca3-a925-4014-a26a-8fc8efc2f0ed", "indicator--32978a0e-36bd-43b3-b5ce-8d653c2fe905", "indicator--f840cbc7-316b-4271-a6f3-0b9fa3be0562", "indicator--c4eb21b8-f3ec-46d1-a7b2-f1119585971e", "indicator--ebb5940f-88eb-40bb-90d0-6938a081f2f1", "indicator--759628a1-3107-4c1b-87cd-9d504edf787e", "indicator--803076ae-1547-4bb0-a58c-241cbbd75c85", "indicator--43bdd3da-f31e-4f9f-872a-7733846439ab", "indicator--c88fcf57-b895-41d8-829e-2d5f1388a8a9", "indicator--0fcf97f8-5ed6-4860-9e06-da5891214ecb", "indicator--5ca5130d-3fb4-4d22-a0dc-e193e023f0d1", "indicator--04d45730-5b9c-4232-b1be-a3bcda819050", "indicator--629aef13-45a7-4ae8-8493-09e7037d4bfe", "indicator--b17f48a0-371d-4d0f-810a-fbaad59c0b8c", "indicator--a7c4d175-7e59-4451-9288-b6c7e207e48f", "indicator--fff3a4d0-ab30-4efb-99b8-ef7a5e2e1757", "indicator--545b26fe-976a-4ff3-a6de-b2e9db063135", "indicator--e49f976d-04c9-43ab-928a-c142b063cde6", "indicator--0c1acebe-6a02-4817-8535-f0fab3294e28", "indicator--c4169428-14bc-4d49-aa6b-5d007d3c9297", "indicator--ec6e6b07-a55e-4916-af51-6f72b27480d0", "indicator--f7bae6de-977d-4097-91d8-64a6509bd03f", "indicator--d5af5ca2-5221-4546-a6aa-02dc84efedee", "indicator--1bfbab64-2b53-46dd-9469-20532d943ade", "indicator--1b484ffe-96e3-4904-880c-3fd0cd10cecc", "indicator--9e674bca-f3ed-49ee-85d9-af701a0bbd02", "indicator--e2897a4f-24c8-4e5b-8b9c-d6b5e6bca648", "indicator--e7ff59b6-896f-4a52-a61e-4e2866f79697", "indicator--aedef478-f1ba-40e8-aab4-9971e0e9bae5", "indicator--60bf0b37-267a-4870-a312-e0ebf2c5fbc0", "indicator--1f74a8ae-ac9c-4739-87cd-dbd1d1099219", "indicator--495aac09-c29f-4832-b15f-57828fb16b0c", "indicator--7d62fc65-8749-49bd-bf49-301959f61a37", "indicator--2a02d226-067a-4911-8f60-4ac389136731", "indicator--fba09744-51cc-4486-b624-4aa6d60059e3", "indicator--378984bb-77e0-456e-9f5f-e45a024ee50f", "indicator--3970a27f-e44b-4de5-b2f2-059e40308763", "indicator--829c67ba-7d30-4946-aabb-1dd354e98d28", "indicator--c2c5fa97-fffd-4354-b9c9-3101fddee7b1", "indicator--7282747c-299e-4f2a-9c46-d34a8883d7cc", "indicator--45b4a915-60ce-4396-98ca-4408c6552766", "indicator--83a4bc1f-a54b-4933-93a5-c7a38c4c4ce0", "indicator--d8577e6c-93bf-4bac-9b15-e5ef14557443", "indicator--84fe7d4e-4744-4faf-a2fd-051c5e442c36", "indicator--f9b486a1-3532-4623-807a-78fad5542bfe", "indicator--3aff2a80-df1f-4f14-890b-20a780569555", "indicator--3e141481-6566-46a5-97c7-72a9c964d9aa", "indicator--054793fe-0571-4d82-9b15-78044e4db5e5", "indicator--05cc3ffd-b6a8-47c6-9a07-202d9390da01", "indicator--679b8f94-9737-430c-ae52-f53218026e50", "indicator--0c422c11-ab52-44e5-8a03-7658cf6d51d1", "indicator--2b5d18a8-e652-4e09-b721-14ccb132cfea", "indicator--ca781089-34cc-4bde-aab6-ceb7b695d4bf", "indicator--48cd78a6-ee4b-47fd-a7e4-db4c91dd957a", "indicator--6cb1ce2a-d792-4bc3-bca9-884d0d761fd0", "indicator--28051181-35e6-41c3-ade9-366183b3d9ca", "indicator--4e8a67c7-4411-4ea4-806e-b8bf9512fc29", "indicator--13cac14f-cae0-4947-9415-28b07b8bdd88", "indicator--308adbbe-c670-44db-9500-ad0b1cf262b5", "indicator--97b49bf8-ee89-468e-a31b-7d685f0c6f8d", "indicator--159bc51d-168f-4fbd-aa8a-01aa4e4c056a", "indicator--02ffc2c0-4bb3-492e-ba63-6eb351fed1a1", "indicator--51385827-a7f6-46a2-a734-cf11f5dd2ab9", "indicator--8adde9ef-d520-463d-b940-a5a013882788", "indicator--691e5536-969a-41cc-b78a-42e763a2787f", "indicator--035b3dfc-f05d-4731-8506-c04931787fcd", "indicator--7976e06c-d77c-422a-aaef-4beee9b7d5f0", "indicator--0f1a4f92-a8ed-4f84-a626-f45939d064a4", "indicator--d77d1520-3dfa-45f1-9768-b50c270f1cb0", "indicator--eb3f84a5-8442-4c53-a777-271771521c55", "indicator--bc4fa28e-6741-4518-af5d-8dfeaaed48d9", "indicator--c2ef83e9-ab3e-49ff-b4fb-0699a1792c50", "indicator--7c25e9fc-3fdf-4fd3-8ff5-e663910fab2d", "indicator--c2c230e7-7782-4c70-8c78-86baa5c4f065", "indicator--c33b5093-6f23-4e24-9e85-30011de04c71", "indicator--edd5adba-bb98-40df-9052-6f5e30e1dac6", "indicator--6b18f0ae-49a5-4076-a141-8b5a7671a381", "indicator--7cc58d12-d906-4fb2-9d68-aeafe04db2f0", "indicator--bdd635ad-b91a-444d-9e91-35d5693ec668", "indicator--0ed0120a-f55e-4ea4-b235-fdc042f5e7bc", "indicator--b9d7f6a8-b1f8-49b0-974c-a35dc32eb1e1", "indicator--a85a070a-2014-4181-af7d-13c4b89d13f6", "indicator--7ddb3df9-2a92-4b9e-a318-ba5895fe4832", "indicator--3eec5b74-2843-4038-b770-a7b9da048ccb", "indicator--26d523fd-2735-4700-8b8e-8212abf08006", "indicator--f68866e4-308c-490c-9ccb-604709eb6cfb", "indicator--58d7e107-f908-406f-acce-39be20863b70", "indicator--dec37022-3a25-485a-b956-e018a6daa556", "indicator--6fe922c4-2084-4718-a1c7-74934ee70d8c", "indicator--f7bf6021-6e88-4262-8fb1-55993baf8924", "indicator--d4c454f4-39b5-4416-94a4-4b68201b8127", "indicator--bddb8e3f-c4fd-40e6-81fe-69a6c1cae019", "indicator--6056ca21-58b2-4988-bf4a-437f92d037b9", "indicator--f69b0283-4cea-43af-b1e6-588f95f47212", "indicator--9c768f69-e93d-49de-b2e5-09beacee035a", "indicator--17d773b5-33a1-44fb-84a3-3b9a733a5ccf", "indicator--d3f58789-0c21-4097-ba09-7cc9c1729505", "indicator--9898ccf1-db1a-438f-8432-36bdfe4c456b", "indicator--c2c3e741-5108-4efc-81a0-6d3d4ecee268", "indicator--fe1b8a55-c22a-4964-a24e-581ff78e69e5", "indicator--75b0d261-0326-4d40-b224-e31a47c58a36", "indicator--a06eebfd-79ea-4254-b485-b0244dcc9b52", "indicator--f8ece286-812c-4390-89d2-00b7208f7d4f", "indicator--bcb96875-d012-4002-9790-5112ff146a08", "indicator--ed47837e-180d-4726-92f2-c00df78dca11", "indicator--c1745d91-2af9-4394-a7e1-22b1ae368f74", "indicator--5af7c847-a9c4-41ce-acba-9651b79629d4", "indicator--8ba188ed-0502-43e4-b449-25a849bc7081", "indicator--c6bfc93b-1b36-4759-92f2-f2665908c8b0", "indicator--606733a3-b84d-47ab-b9bf-6cbfa5b576d5", "indicator--99b2a2d2-3718-43f8-97c4-8f7185277918", "indicator--f116de06-c22a-45e9-8f77-0870cee77d8e", "indicator--46348572-ce7e-4ad6-9c9a-922e5bf7b33d", "indicator--d51bad4d-a50c-4e58-8136-f8eb286cdb01", "indicator--544255c7-ecaf-4269-882f-a4e84963b1a5", "indicator--4ea13112-7099-48ef-b039-877ae35d6a61", "indicator--9d9ae7f9-a6bf-466d-a281-d1604844750d", "indicator--e4e5da1f-5554-4412-93ab-4108ec74b210", "indicator--9f33f135-5b07-40c4-a929-0ff4219e09bf", "indicator--1279af4e-7631-4a26-8c71-f463faeb4919", "indicator--864b4c82-0d95-4ce5-b0b9-b5dd0ead2198", "indicator--ba986867-c04d-4eb8-b620-663da278171b", "indicator--42b5617a-a313-4a38-b64b-7bff98164e49", "indicator--cd5b07ab-6371-4f1e-8116-8762e39ab873", "indicator--00b6790c-fbea-400d-a4f1-82a86773ccff", "indicator--bd5c39e2-c180-4fb6-a180-8003d15424c5", "indicator--8ef72e77-958a-4529-ac1e-460b34c0a45b", "indicator--564626a5-b235-4af0-9932-e799b9ee70a7", "indicator--7fb6f59a-7e5c-4e54-ba02-8ddce88fca1d", "indicator--4ef7f57e-228f-4d0d-b333-db1c9ae28305", "indicator--fa0909e8-568d-4887-bd1b-1d0da013293f", "indicator--2c153c4f-57b2-4cea-9f2d-b6825c45667e", "indicator--f34837e2-e79e-41eb-854c-b9d156e8f1b2", "indicator--85da7d1e-84e6-498f-8712-964796c72eac", "indicator--25be016c-52e5-4151-8330-c66dcdf10904", "indicator--8d6e1ac0-7d22-4704-bafc-ab544bac0028", "indicator--149e1e3e-ae6f-4069-96ad-ad63d4624c23", "indicator--dcd5d12e-aee7-4b58-9ba1-3de2d8c2202f", "indicator--62f076c4-0449-431b-a304-967cbf20a0eb", "indicator--a08319d5-fe2a-472c-9e97-a4561aaceb29", "indicator--87ade067-1bd9-4129-bbed-9e92f85e45d1", "indicator--77e91082-923d-4886-9d8e-bde264359fd9", "indicator--1200051b-6499-428e-9c55-bd346069b257", "indicator--d9ce61a3-c926-49b3-a70b-1ab3cf4213d3", "indicator--81b764da-1c7f-49fd-8c8d-2daf4ae4d8d4", "indicator--4f7b2e49-ea28-468c-aaa2-cc79ac24f013", "indicator--8fb4b463-d18d-46b8-8b77-c15af29689b7", "indicator--62404ff0-93f7-422b-99cf-9c910ee224ea", "indicator--dd8406a8-9c7e-40a7-b28c-ddad0af0c1fb", "indicator--0477dd13-5eb0-4787-aeae-f280a158decf", "indicator--0a632e6f-baba-453b-a291-34d0704ff8e5", "indicator--2eb4e3bb-74b0-45dc-9814-1b3a29a7d1c4", "indicator--4427b89b-32cb-4b35-8163-84fda1795fcc", "indicator--d45c97bf-73b9-4f6f-b85e-1e3620adf3e8", "indicator--37ba7217-5711-437d-bdae-d1b3a01a18ae", "indicator--e18792a2-69cd-4c76-991f-676049b55713", "indicator--a83d9c4f-4a08-4ddd-b549-eb917cb33e77", "indicator--707cecda-6f45-45bf-be17-ff930b3eb66b", "indicator--e37510ba-07b6-4483-9051-bd20ac5e62a1", "indicator--0b43ec52-737d-4291-8988-1844392a2c42", "indicator--c6801798-2685-422b-9691-223d9c976b5c", "indicator--557cfb00-641e-475d-9111-cd16d8391e6b", "indicator--366ff03a-bc20-40e1-b208-5853a05dd0f2", "indicator--54c0c62a-dcbe-4de7-9c4d-bc6926588bac", "indicator--1eabd883-7f5f-4c01-b77c-118cd1a92b8c", "indicator--0d0c2998-e460-4018-a1b4-2c7f2897367a", "indicator--9c5c1ea9-a521-46ab-83c9-78b76e6fb946", "indicator--d31b8010-6c23-47fe-b0dc-e9e9eb7151ba", "indicator--c7deeaf6-fbea-49a8-94f0-233d3992dede", "indicator--aaf51824-78c5-4e0b-96fb-dd78ed46360a", "indicator--76385c3a-380e-4d76-9b12-7086de0d010d", "indicator--8f8d79cf-3060-4c07-b10c-425cd1cfcbea", "indicator--af28da74-67ea-4d0e-96ef-2f65bdd84bcd", "indicator--e1b3c77a-a5cd-4dbd-a1b8-88a67a67cda2", "indicator--04c09f80-6ec2-4bf1-930d-a7e0137315f9", "indicator--9e3e3820-49f8-48bc-848b-a1f5a006531b", "indicator--95f79c5e-2b6b-4fc5-bd69-386208344332", "indicator--20e53fe6-3972-4e3f-a662-e7c2f8fb77d5", "indicator--3923c44f-5949-4b5c-a128-1ff4c44ddeca", "indicator--6506a12e-bab9-470e-8980-2b8722e22149", "indicator--c5bc2567-d60d-42df-8520-7f35e1bbc1b0", "indicator--eb26891a-ed46-4cbe-9f57-a6f7cf86a0ac", "indicator--53f094e8-ff00-4a48-ba21-879188c28a65", "indicator--1527d808-f171-4ac8-9c2e-55b08af6863d", "indicator--0d9ce4b7-83a6-47c1-a774-39f834b7e248", "indicator--0679a38a-1807-43ce-bcfb-5684e64c3dbc", "indicator--59893d6e-6e6d-47be-9889-543fd6cd8627", "indicator--59f33d86-79c5-4a48-a502-f9e87d00fb05", "indicator--b9cf763a-0037-423f-8ed7-8b713c2a5f31", "indicator--e407b68c-9e35-430c-8c49-a68827817f7a", "indicator--87cdb844-2760-494e-b48f-234dfbd9d3ab", "indicator--62965e43-8618-42f1-a79f-a459005863cd", "indicator--143cb072-c1bf-4c62-bb8e-d985e9eb1990", "indicator--df1d5729-c434-414b-8130-9563795d6204", "indicator--2f225daf-ea5e-4bfc-9722-082388b1a284", "indicator--045e877a-92b8-46ea-8e75-ac561f1b65be", "indicator--dae53260-15db-4d64-8444-ef5b8aadc9fe", "indicator--7b1ff0d3-2c9c-4b88-9a21-ed186b0d90cd", "indicator--8fe55a7f-0e45-44f9-93af-b6c18ca14022", "indicator--186241a6-c086-4199-986e-67e2ab4eb0de", "indicator--42d00a1f-0aa4-4196-8ef8-9c07b5368536", "indicator--83408773-2526-4811-bbfa-2a62c36f99ff", "indicator--e0629ad3-971d-43e0-9994-6aee90bd5cb7", "indicator--3075f027-e3f0-40ed-b9dc-1380371b436a", "indicator--414511eb-e2ef-4cde-8146-f4ebbf04d1a7", "indicator--de17b854-67bf-4610-9f0e-7f5d95280043", "indicator--9a14b355-0379-445c-9151-b648b25b3531", "indicator--30e4b954-babe-4d7d-840e-0f585bbe987a", "indicator--508e1853-ee16-42f0-bdd0-c93194a5cf60", "indicator--f2237256-5489-4a50-b4e5-d5bf1dea001c", "indicator--39ae670c-f264-4b79-8753-2c4b33667f80", "indicator--6351e290-6a16-4f75-b78f-e274533e85ec", "indicator--ab65163c-9381-4222-9765-b5b63b39fe8b", "indicator--314020af-7167-4060-b113-1f213d96760d", "indicator--5c8cc5fb-3fb0-4ca7-94b9-4ff86074c9c3", "indicator--9edab80c-92fc-4c2c-b6aa-62aaeec1bb58", "indicator--4440fe84-f016-46ab-b84a-15e71929fdc7", "indicator--96c82ae1-054b-42be-b0fc-840df99f08c5", "indicator--1333e324-06ec-4a66-b51d-9b740a2fc601", "indicator--66eb516b-fd66-439b-9b15-71be30497848", "indicator--0e9a2bd9-58f6-432a-b1fa-28eeddd77da5", "indicator--8d4fe527-7ab8-48f0-98d0-c6b80ed2ac7e", "indicator--838df59f-8e5e-4428-9707-65e701505f01", "indicator--9d372c8c-4b78-4c5c-b771-6ad0c6be73cb", "indicator--d8b61704-f508-4719-a9da-69a79e52b1ab", "indicator--3f3fc95b-2fb9-40bc-9d36-5e7b48fda064", "indicator--85aa5284-c45a-4ce6-862d-f34b571076f3", "indicator--9941316d-d11f-423d-af59-ccd8c74b9c5c", "indicator--7d894ba6-3085-4f7b-83eb-ec24ef1af9bf", "indicator--21407a89-598b-4a72-9876-01760e2ad5ae", "indicator--52bbc9ec-b914-4441-9d32-739073af8ccb", "indicator--5763b730-11f1-41a0-b023-e0ee78351e90", "indicator--211caf30-b809-41f2-947b-f6dd30026e5f", "indicator--3786b54b-20a2-41ef-aba8-43a4a42f4754", "indicator--aa5c9b80-9a90-4516-97e6-be1fc167a1c3", "indicator--5bac1dff-2e4f-4724-bce7-51e011e54ebe", "indicator--706f7a4f-ef08-452f-8833-0d2b2354e387", "indicator--09efbdf0-9a08-4a2c-9979-314fec264ee4", "indicator--df2fb75c-873c-413e-8c68-22b5876df864", "indicator--9a5c9ab9-58c3-4331-8d43-186ee8258097", "indicator--3bf55046-8a6f-4bd9-9d0a-aaf07a16355e", "indicator--8188fb42-624d-4a8e-b000-6414ecbd2975", "indicator--9b39190d-64ea-462b-8de9-fb388fe14119", "indicator--049862d0-96da-4aa0-b89c-3a6a278fdbb8", "indicator--8f713cb8-1ce2-4062-b4a7-e42023687e34", "indicator--796b43a8-591d-42ed-8ce1-90fd9eb9575d", "indicator--77224eb2-93b4-498d-a9de-f07d57642108", "indicator--fdf0df90-c5c0-4494-a47c-733ef1be49e6", "indicator--3fdc5561-d2c6-4561-9953-5e5cab71e148", "indicator--b99d1a3d-6c89-4ef0-bca8-aa2620042825", "indicator--f60e3600-4098-4cc8-a1ad-5d458adda1b4", "indicator--bf29fa62-6f5b-4bd2-a3dc-6762c6951fa0", "indicator--d54d3d69-1a47-417c-8c07-a7decb51baf1", "indicator--32066378-bed3-4fbf-b9fb-b44336ba4024", "indicator--74ed5e6d-5008-46bf-a5a7-959ce7aa8065", "indicator--fde3c00f-8e2d-45ce-bc2d-ef92975cfadd", "indicator--dc634a1f-fede-4062-88f0-6f248d16edce", "indicator--9ee737b2-d9cf-4b26-8cdd-56d4c84b4adc", "indicator--5cd5d277-bb26-45e1-990e-f97610040e6f", "indicator--62399a1b-02ea-4010-8e89-c27ccf364b99", "indicator--3de216a5-6bef-4cd9-8617-434228e63086", "indicator--02b0227f-e8e4-4039-a072-5f73e3fbf486", "indicator--3f16abaf-7202-47e2-8534-6fc76f016ca2", "indicator--5d203bdd-1f87-481a-aa39-0a5760aac2e9", "indicator--3d7539ef-2812-43c3-916b-2903dfd635db", "indicator--0fafe4f2-f409-41ff-8829-5290a570d7b8", "indicator--cc682615-ff8a-4d79-a50e-cd33ceae08b9", "indicator--d2adb4ba-b9e6-4866-93e3-fa33358e6b80", "indicator--74b6992e-a1a5-4ef9-98b0-003df6780bbb", "indicator--3d902b18-7596-4448-84f7-b40d1de7e61b", "indicator--d76faedb-1fad-47fa-b82b-fb1818413cd6", "indicator--a268cebc-014d-49b0-9a30-3c06a9c73698", "indicator--32e96718-147e-4532-9032-888c6c9a15be", "indicator--6ceed244-d64e-4c4f-9741-3793cd2540a7", "indicator--3d474c58-d848-404f-b41a-a8fbc6167d72", "indicator--f4348a82-fe26-418f-907f-481e4b14d5e0", "indicator--13a19818-c440-4925-8838-a2edb8697e40", "indicator--fd2363a9-9c07-4e32-955e-b2b0a5306e8b", "indicator--12e518c8-1aab-44b7-816f-e0df2e95ac25", "indicator--4e61ad3d-5ea0-4d3c-a307-4f67e7dcb970", "indicator--1475d1bf-fc05-438b-950e-e2100da71181", "indicator--ec752390-6ee3-4775-8186-3fd61b594414", "indicator--79b2d083-d64c-4a98-a6ef-2d1adc6d6475", "indicator--35e2675b-7b16-466b-8388-38cc7fa5b08d", "indicator--308aca54-1010-497d-b5c8-70a6d1361144", "indicator--36d2289c-3286-4c51-8783-97119c4bbad1", "indicator--1f1bbd65-8480-4d86-ba60-3679f3710457", "indicator--3b213db4-7bd3-4fcc-a6b2-241cc0d6d483", "indicator--2ce89545-be47-4c39-8d37-6f74a042b49f", "indicator--e187e113-a83d-4c1c-82f4-cbbd383d3c10", "indicator--30d71137-1ca1-405a-9e66-b0288d318a55", "indicator--ecb63cd5-4b47-4e1e-882c-6e92f095e7dd", "indicator--eb0db6b6-e6ac-49cc-9b09-dba0e192a02a", "indicator--785b0167-81d4-404f-8cd9-973c9adeea8f", "indicator--3c5178c9-050f-422b-bd7f-30a6cb184449", "indicator--cb149f99-c30c-421f-b026-a3776256f3f6", "indicator--428391bf-9cc2-4a4f-8443-0138e5ae5e25", "indicator--221d40b4-4e2c-4417-a107-b4efd7a79ffb", "indicator--37aabb01-7806-4e7c-9df3-2bb2a762d566", "indicator--490c283f-0ffc-4c6d-85ce-45bfb0a94c1e", "indicator--20230f92-2f25-4dc8-850d-0de66d7ab759", "indicator--49dcb966-f4b1-4706-bc20-2a0186a39d02", "indicator--2bdcab51-40f2-48af-b9ec-74e21b680492", "indicator--ec3e2746-764a-4e9c-97a7-5861a4a15df0", "indicator--380985a4-ad76-48cf-9249-728a6437e2b4", "indicator--cb7b9c44-4455-4017-866b-99f1f9919814", "indicator--84bbc54d-4789-43d0-acad-67fdbc9c17d4", "indicator--1a88e238-e9d9-45fd-8b76-cc69d083f701", "indicator--0dc8e00e-5362-43af-b0e6-550a7772d76c", "indicator--7d07b728-0c0e-4c73-9975-853ee11b293d", "indicator--4366ed00-e6b0-4ba3-9350-1386f9ea8f35", "indicator--e686b674-fa2c-41f8-b04b-14536571ee99", "indicator--0b4e1665-921c-41a3-9fb6-3a9a67f0513d", "indicator--08658c02-7185-4fd0-b20c-63ca69e7a790", "indicator--22b09baa-ddb0-48d1-a207-f078bb594d2a", "indicator--7dbae92a-9f05-4504-97ee-9b08c3932b69", "indicator--792cc680-061b-4faa-87c5-ad74c1ebe2ba", "indicator--4cae7f6e-f6c1-4a9c-8321-ed6ed7f1359e", "indicator--93f9247f-3e34-42f1-a2d6-4ff5a8c08df6", "indicator--fdb2e9b7-a354-432e-a4b5-83a7cb37015e", "indicator--ca61a6a5-9767-47c7-b490-143a54875568", "indicator--09d3db4c-1101-4e5d-a1e3-60fe55f2240e", "indicator--4027468a-0eda-44e1-a373-3f364427ca96", "indicator--7aa622a8-dde8-416c-baf4-cacfdd123ff7", "indicator--8893e781-d0a3-40c5-851e-e6343c46236e", "indicator--0c847620-ef1c-4f1c-9252-4754496c6ea2", "indicator--cc2bd741-3971-46ef-a550-d2dace65268b", "indicator--18b57398-bc0f-4907-8675-2cc849cb5c15", "indicator--651b59e6-aadc-4ff4-9378-ef11ad93fd3c", "indicator--1245ffba-fa47-48d0-bb24-d656ce268c24", "indicator--e7d30c92-5940-4cce-857d-2d273d779600", "indicator--bec1f822-896b-43f7-961b-7f83b73c511f", "indicator--e5c29340-a116-4bd2-92a3-85a8bf20b60e", "indicator--adfbc9ed-01be-419d-accf-a0aa8ac81ea2", "indicator--add0847c-495c-4ced-904f-b1ee9c01037b", "indicator--152c5abb-e52b-4323-a319-b96ed8f48159", "indicator--ef0017ae-4002-4dfc-95c4-6e9a879d4406", "indicator--cf6caed7-81cd-4e65-b78e-98722ac75538", "indicator--93a365dc-d339-4be3-87c8-8bfde7a36dee", "indicator--081fb8c5-d14a-419c-aa02-2f027dcc56a1", "indicator--858f8e8e-a80b-4661-8004-de33e975f46e", "indicator--b8a66d17-9329-476b-8b81-4c7e1b46e21e", "indicator--6938c1e7-e945-420c-a7bc-f47e214f42dd", "indicator--e514413e-2a30-43e9-8d91-2fa41ac9d403", "indicator--9ce5b7f8-21d7-4bf3-8d66-c4a1130cb508", "indicator--616faa88-af46-4e37-a724-c621b77477e9", "indicator--9b64e367-ed6c-492a-ae12-b64f2c9d2079", "indicator--d8e31948-7956-45ad-bf8e-7c324cad84a9", "indicator--9c1235f6-f821-4061-a46c-abb07ab9982b", "indicator--58800114-52ff-4fa5-9eac-4c8cf213a859", "indicator--0922030e-4fcb-4182-a636-ca9c95a24ec0", "indicator--7c4465cc-af72-4159-adac-c8e5dab51ef9", "indicator--6665b11f-d303-41d0-b374-9129dbc43e3b", "indicator--6e29e91f-4dde-4535-83e4-9801b15ed977", "indicator--be56b8b1-76eb-4add-a323-8ec473e703bc", "indicator--69500040-7b63-404a-a6ff-2dc9918182ce", "indicator--41087110-7c20-4148-9549-d60a20a511c8", "indicator--1eda582e-57f4-49ae-affd-7922b60f56a5", "indicator--27490e5d-c9bc-44cd-86ef-097bf078796a", "indicator--44c9d0d0-10b0-4ae8-a704-5ef5de903d7c", "indicator--658b3d73-efdb-4785-8ce1-5d59486adc93", "indicator--f3f50ceb-3ed4-421a-80b4-723c32a47cb3", "indicator--b80c1ee2-79d6-4c5e-a20f-a51c3360ec7f", "indicator--daa5b9fe-5c69-4879-ab75-365a0827cb2b", "indicator--9741d190-458c-417b-a182-b72716cf7b78", "indicator--21281290-7132-43f8-9bd5-590e047cebee", "indicator--166bb508-6b45-4c02-a039-ea8a642ac971", "indicator--f33a7dcf-81ee-463c-975b-9f541f11f2a7", "indicator--ab516694-0071-4a0c-bcd9-fa3ae4a94317", "indicator--4e0ff2a9-3efc-479d-9ee6-425806265086", "indicator--e3f2914c-530f-4416-a63a-d5d800b666e8", "indicator--504efadc-5321-4a0a-bb42-5ac72578801d", "indicator--5905d27d-eb54-4f2b-bd28-908de69e3cd1", "indicator--60cfa017-a5bd-4f28-adaf-b06dc1b6a65c", "indicator--504e9f28-c1bd-4bb8-9e03-c96d27d27168", "indicator--20f65f93-b030-4ec6-a163-9fb253c12369", "indicator--0a817d14-89b4-4f01-9e73-29f80a7c63f8", "indicator--207ea854-694e-4a09-a481-88021eb23cd9", "indicator--27b08103-9ecc-4971-a8e2-2b3b1c1b90d9", "indicator--e53397cd-bda2-4955-830c-e6486bae4dd3", "indicator--e6e79ff0-2845-407b-ba13-612e744c1493", "indicator--3f336d86-2968-4b3e-ae51-27b72597d071", "indicator--3300d36f-ff18-4b9c-b440-169f0976163f", "indicator--9f608482-5b2e-496f-9bda-0766e9a89eb4", "indicator--fa4b5d24-2101-48bd-8722-3fa84f889b58", "indicator--03d8de62-7912-4f11-8cc0-57474e201467", "indicator--cf1922e2-73b7-47d1-9be5-25a515a7fe77", "indicator--cdb115c4-ddd4-4c28-87f5-6321f00beeec", "indicator--6b28bd46-afea-40c2-8bdb-745af2470b51", "indicator--82f57975-d48f-46f0-a15c-38d9fb0e8caf", "indicator--579dc960-858f-4328-a463-d7d4712e6d4f", "indicator--8d1b20b7-d712-4bcc-8f24-68ad60f046d4", "indicator--94dd65b9-4c20-46fd-a432-08576ec34502", "indicator--d183248f-0350-461c-8c58-8dfde4a4e158", "indicator--f371ad99-9d08-4cc2-8cf8-0392b770dfe2", "indicator--267f96bf-7920-46f1-a0a0-e6ab540aae32", "indicator--152a7cda-088f-47d3-92a0-64945a07919a", "indicator--700dffd3-da88-44e0-978e-ada3bf1de102", "indicator--993bd552-5b37-4349-92c4-12d0ff6d3d0b", "indicator--e4a2c1b2-8e52-400f-8a1e-a760c909a50e", "indicator--e652e50a-a750-4c27-9d64-0629386e9b15", "indicator--1cda9a93-8711-4645-bb9c-1c3939e84903", "indicator--75e31eea-f191-4621-8f69-cc200870b25a", "indicator--50b44c04-b234-4cc0-8e5e-a1b01cc87db9", "indicator--304f9d52-ceb2-4c87-8a22-0aa068976557", "indicator--f168af9a-592c-426d-8e85-0c330485af87", "indicator--6f237d2d-1d38-407f-954f-0b919e839f2c", "indicator--45c43e16-d457-4766-97c0-1e219f5be15a", "indicator--f2bf06c1-a9ad-4c29-bd76-9e9170bf3c55", "indicator--cb22a400-7a4d-48ed-b8e7-ad9e21292e96", "indicator--6812a4ed-f1bd-4838-a72c-d0ad2f5f16fb", "indicator--d6275e6e-3180-4bd5-80e4-c02dfd82baea", "indicator--b8e87780-37b2-40d5-ad47-ec5279cff1ed", "indicator--e6c55d7a-6173-430e-b124-7ac422b97d8b", "indicator--7abf6f11-fb0f-4f34-9cc8-9dcc8f47427e", "indicator--9311458c-b62c-4597-90f5-f2e09aa75882", "indicator--bdf74c52-1ea3-48d0-ab04-c9803bd5be5c", "indicator--cf9001c9-3ee1-4e20-93d3-5865a639bb38", "indicator--4bae680a-f97d-4063-a677-df930034a73b", "indicator--3850b991-f10e-4388-95c3-55e04f626b42", "indicator--f7534a61-dd41-496f-bce0-102a7195144c", "indicator--36184c29-0dba-4682-9963-4c83e30e876a", "indicator--8ee74b8a-093b-4f78-9ba5-2899cfd499e5", "indicator--b9240a4d-bc85-4198-b988-e758799fe49c", "indicator--6ba858f4-9131-48ad-b878-69187e680831", "indicator--e4cc8235-5b11-421f-9c5c-dc1ae37bdafc", "indicator--4151a67e-e224-4078-a668-4e28e248e1b0", "indicator--301c90aa-e322-4549-a7ee-d09ed38f0a6d", "indicator--af62efeb-05d8-4d8b-b416-048fb966ad84", "indicator--37c3787c-9300-44ed-868c-ed8c0054e87a", "indicator--9c914881-a255-44a0-ab11-9ec44104f21f", "indicator--b0be609a-4b85-46fb-a248-3ab998465d7a", "indicator--24863497-bddd-4180-bcf5-723fedfffdd7", "indicator--fde6242d-363a-4246-bf8d-89f0b751cd60", "indicator--f84ab653-50c6-4373-bd60-f0cd073f01fd", "indicator--658860c7-d523-4a5b-94a7-f0c27e8a0a39", "indicator--529e08bb-ce72-474e-82ea-ed30d9930c2b", "indicator--99ff1d1f-feb9-47df-ac8e-7e28c718024d", "indicator--eaf7924d-a319-4820-a024-9e9c7d9a4e80", "indicator--85f5a7bd-85e5-41ef-8fef-d846fcf11b67", "indicator--a3c7c2d0-49b0-44cf-8fac-3c6faaeb0d04", "indicator--24e1246d-ec12-435f-ba2a-5f1f62af84a1", "indicator--be5994e4-7da5-4aae-9f14-f0b16a80ab36", "indicator--813f9ceb-a55b-447e-8200-976d79c07128", "indicator--6c107598-dd62-489f-9b17-2d18c45682ce", "indicator--6607e5fb-11e6-4fe3-ba74-022be42f182a", "indicator--ac9ec518-14d8-4b42-abe8-1b0293761ec0", "indicator--5d0d833f-905e-4736-8305-9d056a3ce105", "indicator--dca75c62-abf4-4d27-9b1f-91405d7e5186", "indicator--11b598bd-e243-4af3-9f7f-8712a7aa6058", "indicator--89b3e7a5-5707-4ad0-88c7-999ae34af7b8", "indicator--e9a80f30-188c-4b49-858f-2189fa5477c7", "indicator--1489db71-69c9-4480-a1a6-38cbb76d5ddf", "indicator--11a1abeb-3b98-4293-9a59-bf407698e73a", "indicator--e211981f-a0ea-4241-94f0-80ba12f50f7d", "indicator--97b1ceb4-49aa-4383-9ac2-457a8f37f563", "indicator--9acb1273-44f6-427d-b58f-16805b139ada", "indicator--408393c5-8709-4014-bd26-c89d12327c3c", "indicator--6b2bc0ee-f553-419b-83d3-4410834ac4d5", "indicator--308e501e-0784-43b4-b767-3e6130984390", "indicator--355321f6-4f79-4160-a2ef-d96b9dd15e62", "indicator--05daa6d4-7621-4e1c-aa2b-b43eb52054bf", "indicator--89248e19-fe38-493c-bcd6-ce6e6378e544", "indicator--59e92aa6-d407-4219-b12a-44ee72877245", "indicator--a3b81162-1ebb-4f30-b2f5-9b3f89254394", "indicator--50eb67c1-024a-4887-9025-8d86c1f806f8", "indicator--31f14d01-2c7f-4ef3-9d0d-2cb6ef41abad", "indicator--21faa8a2-dcbf-4244-8059-240533304081", "indicator--02144ca4-1f7e-47ea-9fa1-3e414a07d0c3", "indicator--d4c46588-0db2-4917-b909-9538419daeb9", "indicator--48344918-be7e-496f-8772-8495d5f005b2", "indicator--9a9925b0-bf09-44e9-89e4-def8871b3e05", "indicator--2e01393f-a010-4a0e-8c92-9b8c35436591", "indicator--dcd3f46b-ff20-43b0-9a34-a58c79f3e228", "indicator--54198de5-1a8f-4b10-b62a-ec7703fadbb2", "indicator--d1c7f87e-7d33-4c2f-a3f4-a5b2b9a76408", "indicator--eaf5c70e-d252-48d7-a5b5-693b9f678465", "indicator--8144938e-1cb9-4151-a52b-261d4445a1ae", "indicator--df95a25d-cb72-4260-b490-9a690fe063b9", "indicator--37f1c7b1-05ad-48e6-9ad7-962e5bd99f06", "indicator--4b8568a5-89fb-4a3e-89ba-42567f57afbe", "indicator--dad43777-af85-40c6-91e3-a9c6c4906574", "indicator--a0d5dfa2-6d4d-4c48-b01a-c50f76c6ad34", "indicator--f154f3b9-ca1c-4c04-806b-e257728e7467", "indicator--c19b75f8-8884-4b43-8a03-7732b4863181", "indicator--4e480fee-9dff-437d-b391-21e8215d6e7b", "indicator--ea3e7cea-f4f6-4620-9e6a-a981622c0097", "indicator--6791861b-c246-4ac4-a4d0-8bb249ad63a1", "indicator--1bb511ac-a705-42fe-8cea-5a8bcc80ddaa", "indicator--2e759c74-ca6c-433b-be4b-78f11740da90", "indicator--4904ca53-64bf-4128-9b67-232b8145c3c0", "indicator--d340449d-2dcd-4207-bd45-7ff6030e8fae", "indicator--01554135-0c50-4356-90d9-829edb27972b", "indicator--b3d15c67-9601-4c39-8f0e-1b7fb8e024d5", "indicator--d20e8fab-8fe4-4c80-8f78-61b838068f62", "indicator--036622ac-a7d1-4b12-a423-60c8cc284264", "indicator--a94e29f3-3373-497a-a177-c3305e34e274", "indicator--fa8e6d01-e75d-441a-baa2-34e60331f7cb", "indicator--b12b3cb8-3a3c-4327-92fd-051d3b872ccf", "indicator--c59756c6-f5a9-4ef5-ba47-561c1621917d", "indicator--da764e70-f03d-40f7-a36c-8b025bdfd9d4", "indicator--189ea21c-7529-4a79-8185-1d44167d055f", "indicator--1c0d7c59-20d9-49f7-8e91-a837f94d47a6", "indicator--d914b292-1f2a-4e5b-aa13-6134bbc01cd8", "indicator--7ac94a4d-d719-432d-8ab5-ae3b85673ca2", "indicator--032f9ff3-4a02-42d4-b434-7d4ada542c4b", "indicator--6930a087-e66a-4ab4-bbfe-364ef9e31920", "indicator--4392bca8-7e69-42bb-b473-5d2564e162ac", "indicator--cd8d8f14-23fe-427d-8ce0-36cf89aeaf88", "indicator--a6e8441a-773c-45a9-a0ee-b346c2e5501c", "indicator--87589342-19b0-4f5a-b3ed-684f0ffacc8d", "indicator--1e0f114d-a774-424f-bb79-49cc5467fade", "indicator--337bd29a-c79a-4633-86c5-353e670afc05", "indicator--7e6381b9-d8b1-492d-84ec-677b23759208", "indicator--2fcd095e-163f-4617-a525-b9f15c51beb5", "indicator--bbb235dc-3382-4018-b32c-d337aaa9a190", "indicator--5e0e2a76-337c-457d-aa58-56483edea3dd", "indicator--f26c4cf8-5c5b-4316-a3de-0fe9c8a1a2a0", "indicator--89e0f43f-c380-4a4a-8572-89e75f6a86f0", "indicator--46ee7f57-6ca9-4bb4-b4e6-c85f9702c6b3", "indicator--322a3e63-4e23-43dc-ab48-91e6e26fbe44", "indicator--5231cf30-df9d-4dae-bec3-c066bda6e34b", "indicator--96b8d66c-a8ac-40db-98d8-ce9b6b0a10e7", "indicator--d64dcba2-b10f-4ad3-a39b-3b55efc4cc8e", "indicator--14cb8ec3-aa8d-402b-8f18-1ae7900d1683", "indicator--5f10b255-2f98-401b-a725-de1813da5373", "indicator--09e8096b-9af1-4731-aaa8-bc4cc5fccad9", "indicator--1681f959-40b8-432c-9475-3c6d2aee1019", "indicator--21b199db-7e6f-4ac0-b74f-98c081972b3d", "indicator--0e0f0484-7889-49dc-8a03-6026ce866829", "indicator--c0bdf4f7-ce31-494e-9db9-0138d62df499", "indicator--44394380-af7a-4fee-8449-26a6a5ae8bd0", "indicator--0de321eb-24a7-4da8-8c55-3ced4ecc3d46", "indicator--a89cd6ec-363a-4a7b-a373-5adadcae04a9", "indicator--7a7620a1-22a6-4bd8-8062-90539b119ae6", "indicator--f2714117-fef8-4014-9409-d33879c90d7a", "indicator--e7c3b5b6-d293-4d4b-9e20-ad9475135dfe", "indicator--9d6fc059-bac0-430d-a170-9dc43b259d03", "indicator--c598acb3-f891-45c1-8dde-456e87626e76", "indicator--920ab9b5-6aea-4921-a67e-d5fb835a8c71", "indicator--598dba47-1dee-427f-88a5-5ada096a4eb9", "indicator--e9e4c23a-1390-48af-8ebd-f8b46ca623b1", "indicator--5dbfe632-5fbc-458e-a753-e9010ffcbb00", "indicator--ce26e4ef-9adb-4147-b290-143a9c6c1495", "indicator--b9b4a25c-af70-4ae8-b5b3-b393afc74315", "indicator--21d43c65-bc93-4e9a-9ac9-a38147908ebe", "indicator--71e2b9c3-edf8-4235-bb58-572cc8e8a29f", "indicator--88264ef5-0c86-4f90-a07f-e6b136d62cc8", "indicator--5d52c280-7b71-419d-8933-825c3b8a55ee", "indicator--8441a62d-998d-4e7e-888e-739d00ad2f4b", "indicator--c6beea41-9b0e-42d7-8525-eb2871888227", "indicator--0f99fdff-5067-4c17-be65-1d1cb81a9459", "indicator--597c3ea0-b372-4d55-9a47-5fa366a349df", "indicator--2aec4d06-1886-4be5-bbe5-fda74030e2b8", "indicator--7d22a897-4ca4-468d-9bc5-8215fd2b68b5", "indicator--399af4ab-3fb1-4692-b496-d938f87d173e", "indicator--7a473118-1c9a-4ba8-9a4d-7a25ce8f9618", "indicator--5cd1d45f-c8f9-4ada-9586-6b978ff402bf", "indicator--4cbbdd1e-a1b7-42ed-8f64-dabbcf9211bb", "indicator--da2bdf7a-724a-4294-b791-a801cfe4f518", "indicator--64d1d1e7-32fd-4a5d-8ad9-9f516b681918", "indicator--01a8cf29-d00b-4077-9853-dda1fa7c1b2f", "indicator--beebff90-9224-40e0-b73e-92ad58e7065b", "indicator--b2d220e6-3a58-4f17-8ce5-1bb504a7ef03", "indicator--69b7ff47-1648-4e28-a086-6839cbe93515", "indicator--b1f7a277-d8da-4fa5-a431-517d9f9e8a5f", "indicator--8117b37d-48ed-47c9-807d-212a0eae7796", "indicator--2b022fd8-439f-4749-b1d7-b5144e4f4810", "indicator--e5b934fc-b179-4472-a040-9f6ebb7678cf", "indicator--df9d1f8e-f704-4b06-983a-d648d195957c", "indicator--2c8b2d33-3b44-4e15-ae0a-e207016706dc", "indicator--8a0e978a-d517-4783-8c5f-61de6f4dd09b", "indicator--566e529c-641f-4b9b-9126-685c28dd5a05", "indicator--82fd9cd1-e037-4281-a443-a335417b7a87", "indicator--ff71561d-a490-4760-9739-262a61b02091", "indicator--f039ba62-438e-4849-9a90-52dde053547b", "indicator--08f7bf64-b291-4c13-a2dc-4c6f93aa1f07", "indicator--eefae3f8-47c7-4e49-af99-0d5001712ce1", "indicator--415fb1c6-118e-4af2-941d-cc51e7aec2b0", "indicator--014321e6-5eb6-4b30-a2b8-1f40117c4b69", "indicator--8fb0b4ae-ea46-4b1e-887a-e3ef0007209a", "indicator--a4cf47d8-551b-46d7-926e-561b8e38d28c", "indicator--7f88fc05-af2a-4664-ad56-c9818aa2b9b7", "indicator--8a4b7f56-fa59-4622-a46b-e05c9a025407", "indicator--e08adcf7-efd9-4750-bb99-415a5eb15311", "indicator--f8a7f44f-3b51-498f-b13b-83feaae8067a", "indicator--104114af-5a4a-433c-87b6-f3e92555c888", "indicator--18717ddc-96cf-40da-894c-b525ca30f75c", "indicator--fac5f52b-f129-4201-9254-b92a83d1a1bd", "indicator--620391c0-28e5-4833-ab73-0f4bbe07c1ff", "indicator--eccc1a6d-5262-46d0-bc74-6f58821a5404", "indicator--fa4fb3ef-7842-4012-a7ce-6ecc05a8569d", "indicator--34e552fd-2994-4474-bb27-83d480f8db39", "indicator--b52c414c-ad2c-4b15-9ad0-a784cd2756af", "indicator--5d5e21a7-a132-4920-89de-760745ecb71a", "indicator--4b9a72bd-b69c-4cd5-ae1f-d62d5bcdfc18", "indicator--b613b28f-4dff-4c42-b310-2d30b5bd5dc5", "indicator--cd97862c-58ae-4bd7-b40f-e3e3728bee5b", "indicator--0026ca3e-2bb5-49a0-bb9a-689079dcdcc1", "indicator--6d88e2c6-d17e-4804-98b8-428fe2c41294", "indicator--3e6c4eb2-f96b-48bc-9b9e-bdd7fe6e6792", "indicator--0446e60d-3843-4f6f-a186-a1ea232083f3", "indicator--e85b23c9-fa55-4a6e-a32e-afdfe2886be3", "indicator--6f9febee-472d-4cac-a7ee-720619e7bc4b", "indicator--0ea8f7fe-53dd-42fc-93f9-618af9abc75d", "indicator--3c8930d9-b4c6-4c86-9e8e-09bc09a77018", "indicator--ed226c78-66b9-4231-9329-1f003d8d56d2", "indicator--54fa6ba6-e829-4f32-bc94-6088d1a9776b", "indicator--9aab0237-a946-4186-b2d8-9874a6244b4c", "indicator--91b6b4e2-c5e3-4162-a98f-1d22ab13c716", "indicator--6becaf7c-f8d4-4680-8060-04baa55b4389", "indicator--44801442-d7bb-4512-a4c1-41a3f3d69ab8", "indicator--b8babadf-546e-45a6-b561-74d8c7dc60b2", "indicator--7af63e22-5b65-4e1d-a068-499a66ffa405", "indicator--10f88f7d-354f-4500-95a6-62df6df06560", "indicator--cc212020-f5d2-4c42-84ff-c902c7de54c9", "indicator--86b8b693-e460-4476-bc25-f8ca702ee700", "indicator--bd672f16-6ef2-4ccd-acf4-af82823f309b", "indicator--b50ad6f6-d335-482e-a37b-0da55dad2603", "indicator--f759713e-802b-4026-a416-15070db19abf", "indicator--6b2cb838-8655-4ea2-adfa-2a8753dd90dd", "indicator--a360280b-321c-414c-bd54-c18bf2117072", "indicator--17153878-b425-4f1a-87dc-46ab84162029", "indicator--da909be6-db24-4325-9f0a-11c21dd3d88e", "indicator--4eb3ff49-724a-4f02-b484-00200af400a9", "indicator--bc050132-ae30-4800-978e-d751bdc2ad51", "indicator--a3209a48-91bf-4b2f-8c74-9a60ce95eb93", "indicator--dec8d7ae-73fb-4196-9842-a58473bc8b25", "indicator--a67f1db7-c8f0-44e4-979e-037eb5ec9cbc", "indicator--228eb816-5679-45ed-b5a7-bfd388e79fc9", "indicator--a6041836-2a6e-4964-9705-710805d3f85b", "indicator--fa44a188-5d67-4e92-92b4-758fc202c417", "indicator--d5103bfb-3054-489c-8802-58f164b5e0ed", "indicator--fbe2f436-f778-4675-843b-8df7204fac67", "indicator--5f869d6d-5942-4d1b-b536-4640793c3e72", "indicator--f8d505e0-7452-4c0e-8daf-0cd41192e2cd", "indicator--a143e826-6d25-4412-a23b-f156576127ca", "indicator--c017a379-2448-435c-bfde-9aa34f80acaa", "indicator--1c8c1788-b74b-4def-a807-fd9625476e09", "indicator--2f434748-c100-409f-a70e-21a73e61507f", "indicator--526d0dde-4396-4fc6-b146-8d16c9086295", "indicator--ceed4979-934b-45fc-ba9e-ab765ee85157", "indicator--73241776-665e-47c2-82e1-7f650efb517e", "indicator--a1fe0016-b41c-4259-94aa-44803fe16dce", "indicator--5e71ea6d-140f-4bce-9c32-f33054263df9", "indicator--64fe8f3b-9d69-4d4a-9791-efa55e07e3e1", "indicator--4ba66eba-c42c-4cc3-b557-f690121bb6e2", "indicator--a7d0ab88-83cf-45b9-b3fe-f9da3b353261", "indicator--9cefb332-6edc-458a-965c-cbb10612d376", "indicator--daad3b67-832a-4831-aeec-8ac34956627b", "indicator--5cfd2909-0f1a-4808-8e39-cfb9a1f0217d", "indicator--d4ece8e4-c882-45ba-807a-cb64bf8884ec", "indicator--2cc3d64a-5585-4f6e-bf17-e07cbd9fd94e", "indicator--f8ae8752-9606-49d6-9d01-ce12c46c87ab", "indicator--f75ff5ae-a19c-4009-a5c1-9c6fc91fe033", "indicator--125c68de-e363-4760-800f-4d3a5d1cbb94", "indicator--1fa973ae-7e79-407d-b0af-29bc4652b944", "indicator--8dfb798b-1297-4663-8d86-ecc53f361adb", "indicator--a1d5bbc4-b721-4f5f-b8ac-4b4fcc59f1f2", "indicator--305e1519-8de2-4cfd-9a10-8f9d08433c07", "indicator--ec02cbfb-fa5b-4df8-9b3e-b98e34e85600", "indicator--32626f32-6d16-4423-9857-61945484db7e", "indicator--62e70b23-8dea-4fc7-937e-9d2fe94faa54", "indicator--d2c172f7-7cda-45a0-b6fa-1e787407456d", "indicator--9031a266-bb44-4b9c-a738-74232efbe605", "indicator--23cea518-480b-4794-936b-ad5267e834ec", "indicator--c81a77bd-9fd6-4622-8a4d-ca39b9be25ec", "indicator--59e19330-76c5-4182-a322-edde73ba7da1", "indicator--740977db-ed33-45a8-8dd9-5b5ef6c2eca5", "indicator--3a81df84-427a-40c6-b5b3-03ff0d339d7f", "indicator--0317e4e1-6891-4481-934b-233a8faf4e0b", "indicator--d95b7767-e67c-477e-9efd-b3c08b2be8c6", "indicator--642795d8-5b83-4b6f-a21d-5a11aef5604e", "indicator--2f90bae0-b489-4d49-9522-4cd5501b9e82", "indicator--2db09ca7-d93e-4787-ae2b-4b4f0782771a", "indicator--7edb358f-137e-4fc4-ad27-c066e1f4da7d", "indicator--6cf13fe5-5edf-4d4e-8f19-1e89fdfed3fe", "indicator--1ac48e07-575d-4c23-9e7b-36236881f456", "indicator--99982b21-6e95-4f8d-b24b-e75f3dd9ab06", "indicator--cc537510-59e2-403a-adef-44f5f2f9b9f3", "indicator--cc167214-d5d7-46ed-80f4-bf058b356acd", "indicator--9cb67877-2f07-4db5-8513-fbe3590d0dab", "indicator--8ed89c1b-e572-49bb-867c-bc7703e81187", "indicator--355d8b20-9816-4f77-b248-85d675b9aadc", "indicator--3800ac4f-7add-4795-a7d2-2c0cd4327c0a", "indicator--de348575-ca8e-4d0a-921b-9361318f14bc", "indicator--236f53f4-f40d-4553-8efb-35a73cf9571d", "indicator--87ee9ca2-288f-4aa5-b198-29ee2ada1982", "indicator--7f42b075-8bec-4ca4-ae94-52a3855eedab", "indicator--70771d01-941b-454c-a0de-f3adb05178f4", "indicator--01409f07-5484-4da3-94d8-c3039a20f51b", "indicator--e17929d1-2728-42d9-a31e-439b57a4bd53", "indicator--b12cb761-037d-4a53-9c95-c0f93d5ea883", "indicator--44fdf3df-d8f4-4cca-acef-1978ab40875c", "indicator--09930705-f539-451a-969b-30ba2f47d243", "indicator--31af87ef-bdc6-44c9-8b3d-f5ba2e648b5c", "indicator--4370de50-d80c-4641-a882-697854510427", "indicator--f3dfb95b-1ad4-42d1-874c-4cc1ffc4a2d3", "indicator--d6231521-f3cc-4f78-9caf-73ae665cf3f9", "indicator--5575e46c-88d5-4f7d-945f-308f46c129d2", "indicator--5517973a-1ddf-4d8f-9c73-889190e195a5", "indicator--17423507-2be6-40a0-a3ea-60c2b53b8b56", "indicator--44c94201-a87f-40bd-bf41-762c8026b110", "indicator--9b595d11-8c39-431d-be0f-8c73f00d0a18", "indicator--ff4400dd-863b-4db4-bda8-6ec6abc43444", "indicator--58b56eae-0478-430c-b2cd-157075d31dad", "indicator--6ce58040-7ff7-4791-ba12-af3e3f1bfa1d", "indicator--27ef471e-3c6a-43a3-b3b2-4d492e8983a9", "indicator--c815d2fe-105e-4fd1-a749-888ad417dc38", "indicator--033d43d3-939c-40b5-a916-843e2aeebbe7", "indicator--cf547142-5c18-444f-9342-efade91a452f", "indicator--e6b61cff-8155-4b07-a269-424b804abc56", "indicator--22ef3466-1fc7-4437-9ca5-bcaac3859ce4", "indicator--72026e33-e953-4a6f-b931-29fe6412680f", "indicator--bda0acd0-2bcf-4a6f-a4c1-4791bd4dab79", "indicator--501f715b-c541-4dcf-9fe6-ea1a9ca081fe", "indicator--b71a32c0-decc-4e35-b231-448287f491f3", "indicator--bb6ba52d-9646-4579-9287-c4410f90e229", "indicator--e59a0f17-ea8d-45d1-9e89-8872c27a38a6", "indicator--8071c1d2-4d88-4b68-a865-2c2958382b05", "indicator--19676a98-394d-411a-9ef7-ebca74064f88", "indicator--f34d742b-64b3-42d0-af73-6b9dd83c1a2d", "indicator--1399bc76-373f-45fe-91f4-625b91bf8c75", "indicator--18dbdc62-75ee-4e7f-b20a-3953f3edba6a", "indicator--88c53fff-dbf4-4274-a34f-d55bd46315e5", "indicator--03d38fd3-6251-4f8e-b782-962538047d67", "indicator--8facf219-c96f-46da-bc49-d284abf696aa", "indicator--fa3bd905-9d16-461a-8d01-5ad003f8ecf7", "indicator--92fd9932-7ea4-44e7-97e0-01ed7edd6934", "indicator--0dfb0da9-fdda-42e1-8ee4-1acb2481e865", "indicator--dad94d16-17c7-45ed-ba97-907480f7a5ac", "indicator--c0ce22b8-34b5-4f42-9d63-4915c0d666ae", "indicator--969e0821-1e07-40bf-9381-ae220d496d1d", "indicator--474901e0-6c72-4785-b0c8-c55cc8427941", "indicator--730e82cf-c216-490d-8603-7ab7db056bac", "indicator--36a673c4-683f-4f27-8703-862a3d2723f6", "indicator--e3b65992-47df-479f-bbe5-3cebc543edbe", "indicator--092c87d7-1c31-4a09-8872-e9d3d16c00e8", "indicator--6582e8db-ba11-4018-9547-8c6098071388", "indicator--e02cf31c-523a-4721-ac4a-7b4288d953dd", "indicator--8c1be848-5383-48ae-94c0-a2436bc10fdb", "indicator--cff16dee-8311-4f4a-8672-4f28284fcd81", "indicator--8535860a-cec5-45af-81e5-fbe721b36a03", "indicator--57bc7a3c-be19-4c4f-85dc-ab1b095b06a4", "indicator--4411ea39-31d7-441b-9258-70d3e23563fb", "indicator--47bde26f-46d2-44ad-bb63-53906592812c", "indicator--e93cfecc-7179-460c-be8a-f56eedfc2946", "indicator--7940a199-b2a1-4ebd-a89d-a139bf919c46", "indicator--d8b366e1-b771-49d9-b57c-9a7e16ac8d07", "indicator--ac7c4baa-f7a0-46fe-afda-32d2e31d900e", "indicator--afe79835-c4c2-499c-8eee-a16f540a0410", "indicator--4bc4b3af-f031-4eba-9d72-bfb7b363d34d", "indicator--263b49ab-46b2-4b49-9b54-daff523704f5", "indicator--e1937631-225d-4e03-beac-0dc47f584f1e", "indicator--c32da738-3106-445a-8728-6c51485325cf", "indicator--638031a2-ceb3-417a-9bd2-bd626c132164", "indicator--4136646b-db6a-4bbc-a413-12f7b4574b9f", "indicator--837edd15-83e1-4485-910a-b9046ba00a1b", "indicator--3c99a59c-7b4a-4464-a266-3abce48cb6e6", "indicator--be3216dd-8957-4077-93f6-2b65d556fe68", "indicator--b56b8e30-0598-4e11-829b-7763df747f53", "indicator--a5f9b848-c11d-430a-b2a2-7f3a0a961098", "indicator--78fcc6de-f4df-4715-9116-b63e628070dd", "indicator--85b04adb-002f-4289-a354-d7febab7a04a", "indicator--fc291da0-474b-4d2d-aa0e-1f69261d488a", "indicator--e29bbc7f-669e-4233-a447-60bf7e2992ca", "indicator--456ef3c8-2f86-40d7-bdf3-ceb052c2a93b", "indicator--52107653-fa53-4085-a46a-f729e357cc51", "indicator--3a9f347c-60af-4d5f-855c-c7f95b23a66a", "indicator--87a404c4-5577-4152-8e10-e6ced81c0e69", "indicator--b8eab87d-25bc-43e8-af25-8208082c7d0a", "indicator--5a6f0d3e-484b-4276-a4d6-3c51ac254802", "indicator--326978d0-dcd2-43ac-aa0c-37a55d225821", "indicator--ad09d1d1-ae8d-43a7-b260-45f868ffbe97", "indicator--dff98657-2f0c-4ae3-aa55-4067a1bfbf15", "indicator--c1f4df21-8691-4e95-b184-01443d83ef71", "indicator--045fdbb7-1cb6-45fe-8c91-645618fbea57", "indicator--85282088-e0c7-445b-a28e-04ac79371e67", "indicator--a2c1e877-31c5-4b60-9c3a-a4d5048b055a", "indicator--d22ff2be-59dd-468b-b451-efc06defb8e8", "indicator--98933ba6-cc26-49eb-a940-43657ad4fb9e", "indicator--477d577f-213c-4cb3-bd93-8808e3b3ccc9", "indicator--b8871424-9a67-4472-9cd6-384f53202a92", "indicator--8941a483-cf56-4a0d-ac89-44c61c24883f", "indicator--7f154da8-e1a2-4f29-bbda-39d165fdb250", "indicator--3799fef2-b0a1-43a0-85ec-b8a74c32edb4", "indicator--45ec34a3-3a5b-4271-9a94-8448f4052cbd", "indicator--ed58ed9c-c78c-4a47-86cd-fa3271168801", "indicator--2306c2bf-4b13-467e-81d8-ec8a3a262d0a", "indicator--b7f47a28-ad8c-4628-9950-b21e6bd6f400", "indicator--e03f3f1e-94bd-4112-83d0-99c80f5db7ba", "indicator--c2079ef0-fd22-476f-9e03-676ffd33c2c5", "indicator--4f91b278-2319-47c3-a8fd-489ef886ad12", "indicator--5656ce49-e94b-42f8-8f85-c3770771f3e8", "indicator--64ec2913-faca-4cb9-9c41-8bcc63aacd39", "indicator--b9b5dbb5-756d-4443-b04f-d47b75254113", "indicator--777449d1-7653-43d2-96d7-5ec408c1c3a9", "indicator--8d48ebb6-277e-4241-a9d8-c4ac49cce367", "indicator--a9998e72-fb84-4a9d-a05c-b484ecabf78e", "indicator--adfa46d9-a257-4157-969a-6cccf03890cf", "indicator--07b9fc64-43e7-4569-a963-88b5784f259b", "indicator--007c2e0f-34f9-450e-b830-0a0ad4b23c2b", "indicator--c4821db6-5d48-4efd-8b96-02b699654928", "indicator--287db9dc-38c4-42e6-b990-79ee8e692019", "indicator--002e8f0f-021e-4937-aef9-e112fc0ab10a", "indicator--8eaa7c65-24ac-4958-b714-e78aa70943cc", "indicator--1a6d30bb-ec1c-4f22-a208-2ae64bb2ae58", "indicator--96c89066-32e9-45a1-873b-594877c32ce8", "indicator--cb41a2f1-b35a-441f-94c2-4b8d8e61bf2c", "indicator--7b84b43c-e585-4522-bde7-bd377f354c9c", "indicator--df1b57a9-924e-44e9-b183-66b9f19b933c", "indicator--478f3b26-4009-44cc-9324-7a8026ccbc31", "indicator--0da48a86-8424-482a-961a-172d5c6588fb", "indicator--e98e187e-9fd0-4845-8806-2ced5647e82c", "indicator--22127bfe-e3f6-41e2-a5ca-ede13d461b3c", "indicator--c1100413-f6ec-4853-ad79-180ecb47cc60", "indicator--83ad8de4-8f9e-40ce-9f56-37cf0c1c669c", "indicator--617628ad-2217-4f3b-a3a2-dd21db54f360", "indicator--1171b64a-b9dc-449e-940e-3bc774aafc67", "indicator--4aeefce0-5248-457c-8981-10fb0938d5c5", "indicator--17298410-5e8a-4c52-a7ae-ba900fcd537d", "indicator--4cc9a68c-d8bc-4cc1-a7a1-38b30feb4447", "indicator--468da4e7-e164-4799-a9bb-bfea3e398198", "indicator--fdfc198d-ce4e-4f6f-a0bc-933d73322d58", "indicator--18ec60e3-4c84-46d4-af7e-3d05c9acaed3", "indicator--a21731d1-0ca4-48fd-96e2-b0dd6c2f749b", "indicator--54d9f4ca-b675-44a8-9b2b-6590f0649dca", "indicator--2e4534be-f378-46c1-adce-ae10518932c3", "indicator--44df76bd-27d8-4196-b46b-c9ffed97062a", "indicator--3e4e913e-d525-4906-9c24-adb8f0c304e3", "indicator--52249d9d-09d6-4491-8b2e-bb80a8905e9f", "indicator--18be7704-a82c-4b07-8c21-1bd47bc435fd", "indicator--55a6e4c4-6b2c-4e44-b158-663773307c1b", "indicator--61c4421e-1311-4c42-94d3-b32425d3e058", "indicator--a11785b6-3efd-49bc-88e5-cacf3b07f3fc", "indicator--c141ba86-f820-49c9-8636-3c4c914d0da6", "indicator--a7287167-11ec-44dd-b229-722f917de255", "indicator--cb69ebaa-fbdd-462b-b4a5-3a71e0c2c3b9", "indicator--c1d48673-8380-491d-8392-3c88dde2166d", "indicator--5278e7ec-04e3-4a19-9f4c-3138707acb53", "indicator--0048a846-b742-403e-b219-1fd364b021e6", "indicator--58d2011c-b788-423f-a549-69596dc7d625", "indicator--3e0f6ee3-c19e-445d-8e22-5f38aedc1472", "indicator--06552465-c16e-43fd-b4d8-88b0ebfb465b", "indicator--7bc3df3b-2414-42d1-a3b4-1de2a218d850", "indicator--69aaa9f9-81d5-4935-a37c-42f9ea5a9783", "indicator--35ad87ed-b875-48fd-9481-679e4d096b6f", "indicator--fad9898b-ea09-42aa-9e39-5533082dedc6", "indicator--5e411511-974b-44bc-94d1-aecdca8c551b", "indicator--93d4c8d3-108f-474a-a235-903e75d852b4", "indicator--c46e6a79-6e35-46a3-bb30-3094c099aa59", "indicator--29a0b695-4a42-4e23-92f0-0448050863eb", "indicator--f38d4590-a712-494c-88e0-5fe6948a5810", "indicator--b6544054-5c4a-407f-9e5c-b90cf54b2359", "indicator--f756ab65-6009-44b0-90bf-1f7cf04efbda", "indicator--41c45d61-087b-410c-9dff-ac804522096f", "indicator--fa96f6fa-7c72-4ae1-846d-971a82c91c43", "indicator--c4d971e9-3945-4651-b56f-e217f57158f6", "indicator--55fc8dd8-95f7-4aa7-87ee-d1a44b8c8574", "indicator--18025092-9953-40f3-8dd7-0be1d5ad55ac", "indicator--b2d0e516-ce58-443d-9947-e2a0fddc171b", "indicator--db0b018e-a2f7-45cf-b263-094fedf6852d", "indicator--6a3c7d21-dfc9-488b-b4de-956a01997902", "indicator--444545b9-1bce-443f-bd56-d39bf05ba6e8", "indicator--3ef9905c-a710-4924-95e7-8e13f654b611", "indicator--1527b31b-7ab4-4c5a-a23f-458c5ba30626", "indicator--bc331fcc-71f4-4eb8-bd08-79e16fb8b227", "indicator--6a0b1bb7-d7ca-4d90-9ac6-42d742898f87", "indicator--9f9d48a8-d084-4632-ae55-b6db1e366496", "indicator--dc22ca97-022e-4e45-8391-2cbbdbd25450", "indicator--ebf92949-a6c1-451c-9353-ece68b07c2b1", "indicator--532a93c6-987f-498d-bc6c-190ec34e202e", "indicator--d09be411-16c5-44da-aa7d-eefd9aa34c0f", "indicator--6f4483bf-5021-431d-ac94-78ce7b4e77dd", "indicator--61fac150-6770-44ba-8e7c-c966f9d57a92", "indicator--2a81dc00-2753-4a0f-8b59-15d74c8c2205", "indicator--8bcac53a-010b-4fb7-bd81-b0db380154fe", "indicator--bdb10af2-bf72-4fbf-bd31-0841e47275b5", "indicator--a539b212-0c88-4df0-abf6-faab97fdf9f0", "indicator--0b7eb113-fc6c-400e-820a-cecb7f194357", "indicator--83b9c499-7d9e-4a10-a0c1-7fec853c6d8f", "indicator--0a3530c3-68d7-42f3-b324-d5e4a0599d43", "indicator--ff0e4876-4e61-499d-a6a4-6a1401dc5900", "indicator--a6002f81-86fc-48d0-9e03-24b976c23e3e", "indicator--f42f560d-eb36-4376-a22e-e1f9df3aab53", "indicator--38beb37d-502e-4875-9eaa-f7c4b5152f66", "indicator--19201c2d-6b18-402e-91fa-f6162ad98d4e", "indicator--6b56e25d-2087-4e40-b279-8a2dc5f10f22", "indicator--c934ddad-b0e9-438e-bbe8-3ff1762792cb", "indicator--8ebe54cf-dca4-4e0c-b16d-5c97e2e9c020", "indicator--f24012f0-370b-4987-9479-f8510a8f64fc", "indicator--8481d018-34be-460f-a4e0-6c77730ea577", "indicator--25dd5bd1-2b59-4de0-ad7b-faaad1781068", "indicator--715fd75d-fdf1-4a21-ad9c-2eb2ca97ca2f", "indicator--084d12df-fd2d-4f76-a455-d2f69fefbeff", "indicator--3d668376-b88b-4118-8ec9-fc8261f955fb", "indicator--2cd681b9-cad5-4866-973c-606e7d9f9e6d", "indicator--2c06195d-7b04-4e19-90bf-126d3dddb8d1", "indicator--e0e10ffe-4972-43f1-b3db-838d0e015c38", "indicator--cc3a9fd7-b57b-4a84-a7fd-df44e6b017a1", "indicator--a3dc09c2-5261-4194-84b2-cfdfbdfa0c16", "indicator--e7deeb9e-aa9f-41c0-8e56-48fd61d341bc", "indicator--86a37d0f-b4cf-418d-b5dd-aae0e106fd0d", "indicator--8abe4d06-950e-48be-b1c7-1ea12c947b04", "indicator--faae5899-3618-4fba-bf3b-71d6acb5f0c7", "indicator--bddf403b-9ef8-484d-89cb-9b6712984454", "indicator--569dc9e0-f2f1-465b-966b-0703c081397d", "indicator--64950a44-42c4-427e-80b5-f1f0226fb8e9", "indicator--1f72317b-f534-42ec-8f2d-2d078abe0541", "indicator--4720ce4e-e18e-4a2f-90fa-e4c422682c1e", "indicator--06e9c21e-9327-41df-9574-4b5dcf576362", "indicator--7e07eae5-2cae-41eb-815e-42bf5cc9da7e", "indicator--e503bafc-1c7b-4fcd-8583-1902f6f76b80", "indicator--9a8dec81-2376-4ba0-9d24-e67d7a398f2b", "indicator--530e4527-6669-4be8-8f37-af4fc1e29263", "indicator--4db47651-c2a5-4659-a3a8-a43cff9ed104", "indicator--88bda15c-5e51-4d2c-87fb-eb6cd11ffb1f", "indicator--48655f68-f405-4770-8760-4cd4265026b9", "indicator--2212a9f3-b4eb-4cfc-8752-9a7f57da6ce4", "indicator--34efe5e9-24e9-4c4b-98b5-c09ecd966a2f", "indicator--4591cd66-3a6d-468a-98c3-623af880c3b4", "indicator--0dfa8f99-eafd-4b82-a64c-118f7c5ac9d3", "indicator--373e54e3-6197-47ea-a541-c5cdc0aa8b05", "indicator--f938baa9-1201-43d2-b3cb-4088b9cdff78", "indicator--2ce19518-e82a-41bd-a4fb-ff8b69a419a8", "indicator--3205b4f8-39b0-43c9-be7b-9f9664f0d4a8", "indicator--7e782a37-f9a6-422c-ab79-023a2cdb6205", "indicator--870f40bc-4f4e-4e79-b599-816be93c12c6", "indicator--5eae7155-dafa-421e-b5ee-608b5d4373bb", "indicator--a59dfc9b-ee13-4ce0-88c5-5ca8eb40c27d", "indicator--fe67693a-4d0e-4898-a92f-44152052a5c1", "indicator--c9a92f5b-9e15-47b9-9fea-5b81dedb07b4", "indicator--c7e751b0-f582-421f-93ed-623d5bc345d4", "indicator--4c3ed6c9-2c28-416d-84ec-e09fb2dbec5b", "indicator--41cc01b3-ad09-4391-afdd-213cac9b26c3", "indicator--0038f3ed-477a-463d-b265-409710a2e151", "indicator--045156f2-a9a0-44e5-b23b-aba43691fb29", "indicator--e0760e4b-ce85-428f-a4d0-734d09bae1d3", "indicator--6d461164-6425-4b08-8c27-bea3d1157293", "indicator--ee670c17-e884-4bfd-a16d-6dbb8dc2b97d", "indicator--a03558f4-2d66-4045-86b8-e82918772eca", "indicator--5442ea7e-72d1-47cc-b11c-16bbf6972e26", "indicator--2aed9ea8-8a75-4db8-a612-f8d2b3e80528", "indicator--276b424a-8512-482b-b1c4-cea2af844a19", "indicator--d3fa1875-b630-4b07-9b8a-e3e0147c1fb2", "indicator--6fb49a60-7bbd-4dd4-89d5-58fb8dc78b4c", "indicator--77dc7a2b-17aa-437c-aa5e-245861d0002a", "indicator--dfb051b2-2bfc-43d7-a379-c17f0455a690", "indicator--760fd798-49b5-470c-8eed-03b8a5774b95", "indicator--c29f4d43-99e0-4254-abec-ee11496cab1b", "indicator--5e1e1f50-59c3-4a48-a8df-028f5d36f797", "indicator--3aa0489a-5f19-4555-a9c5-bc710f1e94c8", "indicator--4e2f0f7f-b40d-4368-9df1-60f9f283fd24", "indicator--2dc7997e-9096-4317-979b-b42defebd48a", "indicator--711aaf46-2e39-448c-a526-b623448ac1d4", "indicator--0943197b-35c4-47d4-b213-a59020211838", "indicator--4f27ca33-fbae-41b1-83a0-0121a2a9401e", "indicator--3af2e76c-eaf2-4218-b627-f28e31ac2170", "indicator--a866f0de-84d9-493f-841d-bb7c318c3deb", "indicator--ba98c19d-ef48-4581-87f0-71ec81abea21", "indicator--80c592b2-30f3-479f-80b9-e31b3f4c1826", "indicator--17a3a9ea-0dfd-4ea1-95e0-b67d69db5c14", "indicator--18a438ef-21a1-49d9-966f-7b7053ed952f", "indicator--2ed7ff9c-5fde-4f55-9438-644523a09a8f", "indicator--e3dd2490-c0cf-4e1f-aa44-b47b0ebb6d57", "indicator--05d72ebc-213f-4516-97ea-1f6cdf69c72d", "indicator--dd2d02a8-61e4-42af-b5c2-6594598bd050", "indicator--b32bc3d9-f386-4660-8739-720df3b81578", "indicator--de4b0a42-05b3-4bb1-be63-761faf547665", "indicator--cdd887b9-35a6-41c2-9e98-333d223011e1", "indicator--e3b92912-5d45-4c51-83a1-f9002247834c", "indicator--be7dccb8-a1b8-4a73-abbc-8be3e6fc6b5b", "indicator--5ff3ccb1-42e9-46ed-b998-f2d43e3d1592", "indicator--6a5f0557-00bf-4ae9-afd7-cea628d1ecd7", "indicator--166f7c21-cca8-454d-abaf-d11f8aa0f0a1", "indicator--1b9ed10e-09dd-44a6-b2a8-d4e3cc386839", "indicator--5df19ae1-3429-4b32-af2a-3a7d9d27e0ca", "indicator--fd3b2f4b-be3d-430c-88c4-cba2845022f3", "indicator--0c200712-e0ac-41ef-8733-7cad277bb977", "indicator--21baf17d-cb05-4399-821c-a1a77b72ef8a", "indicator--416f305c-82b6-4f98-a848-f995477d10bd", "indicator--dd27710b-a1d5-4a86-8402-b5ae820b114d", "indicator--6ec81f5e-6958-4769-898d-8bafb47376a1", "indicator--1dd1114a-8849-4026-9b5e-7817ac21c816", "indicator--bb7923a1-6c8b-4d1a-b20c-c11023220116", "indicator--a6f659bd-8b86-415d-bdeb-f5211f57b5f7", "indicator--db32e611-8fad-4e4a-88c6-e87b5b781af2", "indicator--06964fd4-aa95-4baa-bdb4-a1d81af82077", "indicator--c9b2d4a9-d285-44ed-b897-81ce9f97c6d0", "indicator--ba9b82fe-997d-4d11-9eda-f0887b641c83", "indicator--c270c17c-f9ae-45f8-b0e8-1c4ca0c39e6f", "indicator--4e24a574-da95-4b7b-8ab2-8e1034639241", "indicator--e5e6eccb-15cd-4c83-8558-dfeacf97ea83", "indicator--58cdec4b-edf7-4fe9-b7ec-16283a7b18b2", "indicator--2447a8bd-4bef-42dc-a59c-42a508b49153", "indicator--bcc7080c-995f-4170-831e-03e76d3d60fd", "indicator--1fd09a0d-a6c8-4057-a6ad-f907184f6009", "indicator--92f09011-f113-47e8-85d3-8f52365d1849", "indicator--28c63f8f-7019-4c59-a6cd-f5e7dd64ffd8", "indicator--d769c27e-394a-47a9-9d1d-7b0dcdab1c5f", "indicator--c94a39cc-6eb3-4553-b5c7-9da8f1fd4616", "indicator--99b3f57f-9307-4c2a-9bab-4cf8c61eb03f", "indicator--14eb3147-669c-4d21-ae3d-0a042d7f48e6", "indicator--be439283-6817-4f3b-996e-03f14364730f", "indicator--663aee28-31a6-40f1-9d8f-37ad0d531e78", "indicator--20e4d212-ed28-4fec-aa40-3b59ce043dfe", "indicator--82eaf7b0-c930-47c2-9748-74c02756dbe1", "indicator--71063604-f2dd-45b9-a941-feb269171699", "indicator--a7d8a199-572b-406f-be1b-dcff3df143a9", "indicator--f8df2433-3624-406c-b82f-dba12f382feb", "indicator--4ac8caab-dc9f-49a8-94c3-edaf245cddb7", "indicator--09b54287-d092-491c-96a4-f9ebe2f35718", "indicator--32c01d81-5ca0-4b0d-965d-1cf3ca65d553", "indicator--0db423e8-6781-4093-8400-b60916ec702e", "indicator--3b3f0662-2182-4786-8f4d-0b335d39120a", "indicator--282e4154-3ff9-4dda-8f91-ee68c4753ffa", "indicator--741894ae-339d-483f-99b6-1409ed0d63f4", "indicator--21830925-a100-490e-8f29-d20af7397a8b", "indicator--c382e206-70b1-4f30-bc10-760e6b1848db", "indicator--6881b229-f2e4-4c34-bfff-fc626895b519", "indicator--47fe2a0c-1f6b-473e-b34c-74a3926eaeea", "indicator--b4548eca-1cac-4873-87e2-6eebffdc4477", "indicator--d4251013-6480-4046-9918-c5901e8ed559", "indicator--6a6d986e-1ccb-406a-9c13-3e1aff33e069", "indicator--47ef0430-0171-4d30-84d5-1207d7f901b1", "indicator--94a774de-1799-444c-b07e-41b731a6b827", "indicator--8fa2dd94-99a4-44e1-868a-9ef2cd1a1766", "indicator--547f79b2-16fa-4b13-a579-991fbcddca75", "indicator--1184fbca-747b-4ccf-afc8-1ba7474e2fd8", "indicator--86f9a803-2c2c-43a1-afb8-65ae81091821", "indicator--75b40caf-7410-40fe-a292-10d5903a5784", "indicator--ee7e54d1-0b82-46a8-831a-0cae2642924c", "indicator--7e87d756-4162-496f-8cf9-b77799ea1e33", "indicator--e8f4ebfe-a1bf-46c5-826d-27bb221ebbba", "indicator--b4befa4f-f8f9-4705-b211-3bd113e2bc68", "indicator--f03bcf41-e096-4696-ad54-35f972b0e68c", "indicator--e4d6311c-7b28-4221-8d49-aca962d53038", "indicator--558a7ad5-7389-4482-86d7-4d396a5030a1", "indicator--116240db-2469-4b7d-9027-09a0c730372e", "indicator--580d093e-39b9-46ab-8091-54de62c4cc21", "indicator--a174f5d8-8a87-4675-96ef-4ca9953fe3ad", "indicator--3a064230-057c-47e0-a4fc-9e359bc5c968", "indicator--68d201de-9ec2-482b-846f-1de568f6bbb9", "indicator--45a3ce7b-614c-4e3b-8c1f-a55073917bcb", "indicator--d4ea5c9e-20fc-4e6c-8aa2-8be0e52b69cf", "indicator--2dc4ab8a-df3c-4672-b15a-524c800480e8", "indicator--1a21769e-5266-4f75-821f-7b604bab473a", "indicator--d619774c-993b-4761-814d-0e165cee960e", "indicator--e2692274-3b32-4a3d-b1ae-aaeeb1631b00", "indicator--6da592d4-12b4-4fc3-9855-4f40ea48ecdf", "indicator--3717f0f2-b736-4c8d-8738-9156f60c0c5f", "indicator--0a0899a0-acf7-4da4-b859-63088586f975", "indicator--8afaf541-0961-47a2-8115-02b450bf8eda", "indicator--573bde41-805b-4f23-8038-a0a0679fe341", "indicator--94991cf0-3678-487c-b85a-16073e6d6d76", "indicator--f8e2d6b4-e328-420f-be50-e9b280892fcc", "indicator--5116cf1e-21cd-4e7f-ba15-5c6dda03f469", "indicator--15d4d235-cbe5-44f4-a1af-4d853f5b07b9", "indicator--67728f5a-46db-4c9d-b829-9a3a1c475584", "indicator--15fbfb34-07ad-4a13-a09c-b68a6d405ad4", "indicator--e4a9a994-85f7-4668-9f8d-43cd32e03a58", "indicator--0e662f14-0b8f-4e64-b612-ec2add1959ce", "indicator--7d994ad1-b7ec-44ed-a33a-49cfd34aafdb", "indicator--50004bc2-d2eb-458e-bb91-ef08bde9d602", "indicator--4ba4924a-35c9-45fc-9ac6-454762cbb641", "indicator--b640d619-a5bf-4114-b77d-d85947f200d4", "indicator--57a7bfc1-d48f-4291-ba49-5a43213b798a", "indicator--547bdaa3-d026-4c25-bf48-41d2e085e3f4", "indicator--6281a8d3-d8ca-49b2-b906-21a438566a9f", "indicator--9a1bb383-82fd-4d66-86c5-b31279ac87b2", "indicator--1e09fa5c-53a1-4f7b-a9c0-8143d668cc4a", "indicator--2290a549-0751-4ee9-b0f8-de4d8152505f", "indicator--8aa1c5f3-0b41-4abb-804a-5a15ce48e5d6", "indicator--7db78e1f-49a8-4ad0-a058-11df7b1a0a40", "indicator--ff6d4295-84a2-4e01-90b1-f0077e902bcd", "indicator--ef3db052-9195-4f9c-8321-90ae4b67521f", "indicator--ab09940f-4e11-4033-8e2c-ff706b33245f", "indicator--5c2a404c-84e8-473e-8aae-f1855700d556", "indicator--3e637a24-62c7-4cdc-b21d-d0ba220eb004", "indicator--d11232ca-98f7-458b-bd6e-702a8e207077", "indicator--d2a3beb6-1a38-4daa-9d29-2a04618be3a1", "indicator--3a3befdf-f479-4c8f-b916-a4fc8f8fb08c", "indicator--3b1e338c-c8ce-4b83-8d7c-56e0255fd1aa", "indicator--11e1fcde-8f2b-44cf-8d03-ce45ab496e49", "indicator--14071da4-48b5-4ff8-ae26-25f651734157", "indicator--e164e894-114c-457c-a562-e233a3c7bdbc", "indicator--ff5130ac-ab17-4362-9d54-b9730ca194ca", "indicator--f70a196e-eb70-447a-913c-92a4f65778d0", "indicator--cdc7be02-2cc8-4cfd-8bad-c676c42b21b6", "indicator--a1d9801f-fc94-45b5-bf8c-ee57d1ab489d", "indicator--16358e49-8180-4839-8f73-68c199f9017a", "indicator--b63e1b38-d45c-467a-97ce-96e8c564deaf", "indicator--84ead3dc-64f0-4585-bb77-b996994a51f4", "indicator--e411458b-38ca-40a9-9c13-3621b29cf3d7", "indicator--94f6929c-eb70-46d9-ae34-78220a731107", "indicator--8f2ef56c-16c5-4f44-bc61-752583d88468", "indicator--5a5738f5-c180-4614-a711-467d12751d07", "indicator--ee1f6dd8-2c48-489b-9522-6b83cbe3a894", "indicator--08deb22c-4616-400f-81f3-51c270258356", "indicator--dbb81720-03d9-46c1-ae9f-3f08e863cde3", "indicator--c2c237d3-eb53-498d-bb99-4b4a7422103b", "indicator--8f5bb007-2b0f-43d6-b109-d792bd08bc28", "indicator--413bba96-147b-43d5-a9ce-5b6116f52147", "indicator--0b334c02-02ff-42c2-bfb0-dcc803637316", "indicator--fdc79906-cc2c-4859-adbb-e6a18ce3b0fe", "indicator--4a4b48b8-e1d8-4696-ae10-e22bc927e302", "indicator--19ecd9ec-da17-4883-9ae4-fc56d3938d51", "indicator--b2bfcd91-3d35-40a3-ae70-5c136f3743e5", "indicator--c08b6685-10e0-49de-a1e7-782e44d9c1cd", "indicator--0e04c257-9423-45ad-a9e3-be4f02b2ca83", "indicator--41580b7e-342e-4e6f-9662-72c3b00ddd4a", "indicator--7b29ffa1-e1cc-409f-b57f-89cb1c9d4eff", "indicator--c04d1976-6904-4f8d-8658-0de73499389a", "indicator--ee2ce5be-07b4-4ba6-b931-f35afec076bc", "indicator--3993b67c-7d36-4ca0-ae86-7a296123edf0", "indicator--23ccde5b-d62e-4376-8b88-1d5ebc9f1a94", "indicator--d5a8d32e-fd58-4390-a0bc-a99ce4ff3c53", "indicator--8d45773d-9bcf-43d4-819f-e442e9d95927", "indicator--f051a7d0-f13e-4d2a-853b-e48956f80f16", "indicator--404a22f7-3a22-4f0d-a8b3-a8cd73839bef", "indicator--1e146029-2ca9-4dc4-95b9-ad137ed1202c", "indicator--d6d41f1a-7d94-4ed8-b408-0f5bfc973560", "indicator--b2bde2c2-43b6-4ee2-ab69-41b4d7e3e0a2", "indicator--27bbbc8d-36a2-4637-bffa-a9ed6efbab9f", "indicator--b797ff5b-d90d-4bfa-a5d9-5230d69a1260", "indicator--3c8a23af-bbd8-4a3a-8832-b40e9df1d6d6", "indicator--d40ca271-a23a-439a-80bc-5897f0fa4e07", "indicator--6c4e413d-6bfa-4e5b-8bbb-44b43827fb1d", "indicator--70c4d849-b5b8-4185-9010-f4af4f0218cc", "indicator--27503f02-8ee8-4219-99f4-701847b34712", "indicator--2685d92b-36ab-4a2d-b479-f33072dcbd13", "indicator--ad4a8770-bb2f-4742-9bbe-c7ae51db7760", "indicator--c90c7067-25b5-49ce-b7f2-932934475724", "indicator--02c4e3df-79cc-48e3-90aa-9d8b4b2e01db", "indicator--7815f4a2-9229-4c38-8cf2-8cc913265a30", "indicator--843926f6-2ce6-4a98-84a4-eebc81e96522", "indicator--e7c69206-c223-4210-85b5-42cb6c3f9ecd", "indicator--dd4baa3d-08d1-4edb-98a9-dde98872a60b", "indicator--9b178a80-70ac-4aaf-8cb2-4c58508a070c", "indicator--c41d96af-cbda-4bdd-83f9-efbc8ec290a0", "indicator--2ebca072-3962-4614-b0cf-7ba1520e2506", "indicator--9a73668c-0ae7-4239-baef-c34c27b9631f", "indicator--3884457d-9527-4e07-9e1f-dfc5adf346bb", "indicator--4d95005a-7c67-4eb8-b120-baf2cf5e1cfd", "indicator--66d97483-6b92-477b-b4c7-8fadf20c1046", "indicator--044dc7fd-9879-4d99-a5ff-9822cbbfa81d", "indicator--3b509d30-e6c3-44e9-8385-5d33f612fcb4", "indicator--a1befe6f-6218-4ee7-b18d-8e86d58aea92", "indicator--7f2590b1-50ae-4e2b-8ce1-8fa4727390f8", "indicator--9789424b-ae0e-4fc4-a29f-908545eed740", "indicator--b337d525-19f3-4f88-812b-329965f1eaf0", "indicator--db4f1c6f-1d54-477e-9f51-7e843df247a6", "indicator--272d50fb-7ad8-44f9-a617-425c7ec4e1c4", "indicator--eaadccc2-f5d0-4314-9363-b128368ebfd5", "indicator--26d225c9-4f9f-49f2-bd2a-9f0c7cf621cd", "indicator--e1a99543-f8ca-4d4f-b157-ec72f24efcd1", "indicator--e7c88d47-7f53-40fb-bb9c-a7442b186af9", "indicator--442c3669-8be1-4a98-9e67-7fc655364cf3", "indicator--9ddd3f07-d92c-45c0-be9e-7709dfe71fd9", "indicator--c0a461ff-b1dd-4874-bbbe-2cc7f19f7b29", "indicator--09230a8c-3744-4c81-adaa-307008bb89e7", "indicator--9606dd52-775a-49fd-aced-41f2bf0a1b94", "indicator--585daf88-1655-4ed2-be10-68a3d26320fa", "indicator--89daf3d3-ee69-42c6-9f9c-d24794d5c9d7", "indicator--3b5da0bc-2acf-4243-8ed2-f6906d7873a5", "indicator--e7677244-b69e-43cb-a3b0-bb6f06b7a577", "indicator--894c791d-961d-4361-a289-e9b7266a70a9", "indicator--3d4b1aa9-212a-4a94-aeaf-e99e6a763d59", "indicator--aa084a3c-0207-4224-b22d-c2a1b845c445", "indicator--8796c0ad-ee6a-44ce-991a-8d933553f5b0", "indicator--c43e203b-78d8-4add-a0dc-6a184e43cb19", "indicator--94c62b65-bb99-439b-94d1-97355bd3ef69", "indicator--b5427ad8-43bf-4835-9bf3-c262e023f558", "indicator--3c067421-db72-426c-8c54-c45018ef2972", "indicator--dde0a19e-1c00-4cb1-89a9-de8df753a0ae", "indicator--c760f7c2-4be7-40ff-ade1-752054da7202", "indicator--60e7ebf4-6be5-4713-b271-87119bf6cd80", "indicator--56cfadc4-11c4-4c9f-9714-08af71872114", "indicator--9456c2ae-8071-4b68-adde-66c4db443e90", "indicator--380d6003-d366-422b-9376-263198e13a68", "indicator--12cec4fd-7606-49ec-a146-931ce0e67708", "indicator--d5cd7d86-c25a-467b-bec3-7e4cc7e4d943", "indicator--3b98f916-6706-4c01-b893-9c86c376547e", "indicator--e3ef1e0a-7aae-4647-b2e5-060be26f2b03", "indicator--f5a4ea6d-fada-4c4e-af66-582db10b44fe", "indicator--773bce9b-4435-41d0-bd07-9f23bb3d69c5", "indicator--9618c073-93c9-4a76-87ba-cc8d33c1381d", "indicator--b5a82112-e73f-4a14-8e0a-1b317fe27a06", "indicator--ac1e07f5-0a45-4fc6-9394-450725cf912b", "indicator--4885d8ca-b983-47e2-ba6c-8f234526de8e", "indicator--44c4804a-d604-4ff8-a56f-da0beb45e337", "indicator--5fe5eaae-c3e3-4520-becc-1163d47a7f5f", "indicator--a50abbca-710b-420d-88b2-10be56b79cac", "indicator--61e1d4e1-c0a5-4c20-9ddb-a5a8e36bf86b", "indicator--f6e287f2-fa6a-4675-9a9d-f229df1ed98b", "indicator--afad0bbc-0b81-4249-b164-ce464c3c5761", "indicator--cc0f517f-84a5-48fd-8629-cbffc7c18568", "indicator--a68cd76f-5a6b-4819-8fd2-a73d800f1f75", "indicator--4c6fa8fd-a3d4-41de-a204-0f3dbfca008c", "indicator--46fc195e-e087-412f-aff3-2984f5bbfcac", "indicator--94ba1c3c-4ad6-4881-9fbb-6b1e2e89b853", "indicator--5013d6c3-8dd6-4e65-9f33-1ac8ba0964fa", "indicator--c9ec4561-b4cf-4cf6-b415-d703c61d3f86", "indicator--3ff06c89-9807-460d-b38b-6bfdf564ea2a", "indicator--2a306500-58ed-437d-a77f-997426ef27fb", "indicator--43bef25c-64a8-43c2-a842-990933f8740b", "indicator--35251dc8-4195-4c6b-a93f-1b2c0998b0e7", "indicator--bb8031c0-8b2b-4e39-9325-0f5d26d26e10", "indicator--fd597871-40cd-4b8c-91cc-bd26e5bcfd02", "indicator--42a8d7fa-957b-45ba-9e04-af94875f3752", "indicator--80b719a6-4f08-4fa9-8f65-6a7010c23035", "indicator--0ff7bf2a-74d1-428d-98e2-c22cf5a12cb9", "indicator--6cd569d5-57d9-4871-a8e0-96421d862521", "indicator--bf6c52e4-07d0-4199-9977-4f77fa73a525", "indicator--163550ff-bf52-4dc3-9c17-04d07dce410f", "indicator--63f69c9c-984f-4fe1-9f9e-c366bfde712e", "indicator--db75b11f-fa55-4a00-aedb-7b99604d6a26", "indicator--67cf3213-6ba9-42ca-92ab-f00d75d41d13", "indicator--5da1f9b5-1f95-4153-8f78-0a97d5576d55", "indicator--06ff55d0-1539-48ec-88f3-0452829a86a4", "indicator--2dab4647-a2b3-455c-a7d1-ab231223c376", "indicator--d39e93d7-b776-4dff-8257-1aef19856f11", "indicator--cc0f5820-f967-42ae-a3df-e32b1da43a69", "indicator--709d0df5-700d-48a4-a52e-4852320c0939", "indicator--688b09e9-8cd5-4d91-a999-aef387f559a4", "indicator--170aded4-f089-4913-87d2-b8d759285561", "indicator--93e36dc1-9a80-464d-9aab-258816cd97aa", "indicator--b7c07bae-b82d-4ac1-9bd3-e20a41dfde73", "indicator--3daaa036-904c-43ba-b56a-d1dfd15cbca6", "indicator--6a8a5b62-9dce-48c4-b3cd-956179a79a91", "indicator--16a705ce-02b7-46a8-920c-48a2a516b995", "indicator--5e6129db-81ca-44e0-8a87-ef9dad062b22", "indicator--2b88c8af-267a-495c-827a-de4a41694042", "indicator--d99c2165-a0a0-40e2-97a6-95ac23ab5153", "indicator--f9aabd20-a238-472c-9276-be98b925046f", "indicator--978014fa-2c11-4e8b-a3a5-ae9c1c892de6", "indicator--85e12c27-1698-4c47-a9a1-f0b784c197e7", "indicator--530d7c28-c9f8-403f-9755-f40a5332550d", "indicator--7639a240-8971-4970-bfbb-4431ab1c3c7b", "indicator--f1fdd76f-03bc-4fdb-ab6a-54fcd52a7f55", "indicator--c546734d-9b18-4941-b88c-6da0cca2637c", "indicator--90b04378-6cd6-457e-a72e-780c712cac2b", "indicator--1e6320f6-4d65-43ec-bc40-c737b7c11c22", "indicator--2bf280bb-6a97-476e-a317-35ac7e429a2b", "indicator--6e7fd0d8-11e9-4f20-9851-872536137bb3", "indicator--fd42fe18-44ed-44c2-8545-c7583944f53e", "indicator--67298bda-14c7-4618-bd4a-40a209104db9", "indicator--a622f766-4fb1-4b2a-a471-8555db96f323", "indicator--b1a3ee1a-3ab5-454e-8db1-4e33e48e4f6d", "indicator--a2faaddc-85f2-45fb-af14-8b1d9edfd82f", "indicator--17132ec8-733a-4dab-a54e-b2adbf089661", "indicator--ce6c4555-4f9a-4ecf-a259-c0dbd4a50ec1", "indicator--baf857af-15d8-4f4c-be4a-fdb1b72a6501", "indicator--099ac778-beb5-43b3-a9e2-1e844aae5dd9", "indicator--4e683b80-9d37-4072-9cb5-cd57365f80e1", "indicator--7ad93b43-9f24-4d8d-9de3-354198400ebd", "indicator--4f93b734-a318-48ac-b459-acb508d7d9d2", "indicator--9b19954c-a74e-4c1e-b2de-b22d25be9f10", "indicator--935051e4-1e29-40bd-9c2a-243b1bbc1c8d", "indicator--2c558f6e-4eda-47e1-8080-156451f3cb95", "indicator--74611759-1d5b-44e1-b705-6feb36a2f39c", "indicator--e1d141ff-76de-41e2-8f9c-1b19291925be", "indicator--901ac5ab-70d1-43d2-ade7-1760c24e513d", "indicator--c99692a3-d95f-415c-8354-af40f41c9b4e", "indicator--1a57cdbe-614e-4624-8729-2807a2b2c510", "indicator--9d3f995a-b99b-4554-b534-352dd1e4f088", "indicator--1249e762-182a-4a43-b8dc-4549f165d50d", "indicator--2aa4abec-5997-419e-acca-f7251d06e2e2", "indicator--79e33c06-7126-4b90-be53-b2e069dd332d", "indicator--c241bf4d-e77d-4b13-acc8-35af8a5ffcd1", "indicator--2b479a43-d49c-436d-8197-5f27df119500", "indicator--b1198473-ccb6-458b-91cf-d54abac54e37", "indicator--eb599c9e-044b-4480-9ab4-28cb55b2c82e", "indicator--67c3b5bc-1398-45f5-b2fc-5bd105db118e", "indicator--b4ca491f-6644-4823-a46e-0b94bae17600", "indicator--e0c56a43-8303-417b-9805-66ba6feec08f", "indicator--ffa86fe0-5450-45f7-a354-f674c2618a39", "indicator--0a281b50-04d1-4aec-9fd1-9d79ff8264f8", "indicator--9a5c1ab7-925a-4182-bdfc-01fd0a201e27", "indicator--8f41e43c-a73e-4014-b029-36195a821a1c", "indicator--ec172b7a-a23a-4507-b68b-eee7f4a57cef", "indicator--244d425d-1d15-4455-9cc1-444058cb1d50", "indicator--ce21b547-a51c-418c-9883-b38bfc91a083", "indicator--5b900a81-0034-4270-a197-e6cf545d67bd", "indicator--d6895ef2-def6-4ac5-a7e7-4b016ef96afa", "indicator--6343e3ab-770b-43a2-b527-97d4acbb4cbd", "indicator--c4071eaa-b080-43a8-8865-188fc8db0c84", "indicator--6d7df0d1-0e68-43ae-bfc5-15d1987b34d0", "indicator--3f55e9f8-c403-4469-9a3a-e5d1e30a5d0e", "indicator--885a0c81-4018-4de5-bbcc-c4d5f3ccb039", "indicator--c4550510-1c60-4aa4-8754-f7ec130a0f53", "indicator--5b84f997-daa9-474e-be41-3d6780304f47", "indicator--5daac41f-08c1-4fe7-a9f5-e80b3b62c440", "indicator--0d5e0d82-d74e-42bd-bb70-5bd7cbddc474", "indicator--7eafd7b7-5239-49f3-b8ca-1fd13d205a17", "indicator--d8f70f26-69a7-421e-9bc4-4589743f0f26", "indicator--4c81806d-5cec-490f-b410-2c2c0a17a4d5", "indicator--b6c4551c-2654-44dc-bd8a-642b3acd15fd", "indicator--6941c644-c997-46e9-b21d-fc08a4f74154", "indicator--06603f45-80e3-4004-a00f-7b466604d290", "indicator--ab01f007-7bd6-4247-8947-cbf8b6c28755", "indicator--438622a5-e076-4410-a4fa-f5c847283d63", "indicator--13245e95-343c-45b6-ae3f-724ddf5787ee", "indicator--aedf32ca-7016-453e-9b53-50a08cf2b746", "indicator--05309091-b387-4b2d-8552-165e6be590b1", "indicator--4c1775b2-9175-48e4-a545-b084ce9cda4c", "indicator--12dc2097-0801-43b3-8344-a34ae128742c", "indicator--a0c6fc55-55ac-423b-9d49-c7630aad84b4", "indicator--7ce72907-4976-4a6c-8cfa-1ca9a128b67e", "indicator--f48b884e-098a-47dd-908c-79782e0adb0c", "indicator--7dd322a9-f689-4edf-9356-15faef89d73c", "indicator--fcf6fcbe-2575-41e4-8dcd-4f3ec5cf4150", "indicator--46580213-eee9-47f3-af84-2b7ee1f09979", "indicator--326f37ee-704b-4f7f-bc75-763b39a14cbc", "indicator--33d8e490-419d-4f33-95c6-172d5ca20b59", "indicator--fe8550d8-ffe7-4099-8195-7bf96d1ed1bc", "indicator--8e64b199-27fd-4777-bbfe-cf5c3d5e07d3", "indicator--7499cc26-f091-46f9-8fae-62ec8bf3e3a3", "indicator--f77f8a5f-7192-4554-9b83-e1aaf6c6de2b", "indicator--322c46c6-aa5d-465f-9aa5-288de4bdd406", "indicator--d56901a5-2ff2-44a7-8b62-6150578a99e1", "indicator--1d8fc546-aacb-4a4a-aa10-df22103d099b", "indicator--91d3ae41-55aa-4698-b9cf-c1d0b10d42a1", "indicator--5aabc9bf-514b-4e21-99cc-d7725f445c62", "indicator--13c63036-e8e6-4ccb-8897-7ef4d6c115fa", "indicator--ac87c89f-b4e2-4929-8f67-43808f083102", "indicator--454c4071-ce1a-4c12-8d0b-970f110434df", "indicator--463dc40d-109c-4f6c-9253-875348b6e3ef", "indicator--2e22f0d6-fa3d-4bb5-933d-69d70c174182", "indicator--d9cde093-0472-45e5-a6ce-a7e5d53276bc", "indicator--9262e7d0-0254-461d-9566-0cd1f9f3e2e8", "indicator--b69121a0-924e-4d41-86e2-28d8ee3f9bd1", "indicator--b4643827-995b-4e17-ae3d-863c9450fb6c", "indicator--3cf0478a-38bd-4374-a9cc-08b3258e6d41", "indicator--754d1e8a-11b1-4c6f-a17d-210c1add1818", "indicator--867da7fa-1e75-4295-a0e6-4650049d8b5b", "indicator--ce90000e-ae9e-49b3-8bfd-9a7c6c9a0fa2", "indicator--d5a0869c-ea51-471c-a1e1-f186da1d9c93", "indicator--d054e665-50c9-4613-a6f5-c60b6da36c87", "indicator--047470b6-67d0-40fd-afb7-b69064e81c73", "indicator--b15df675-7ab7-4f56-b4a9-636e726f0e43", "indicator--cb7416ce-b697-442d-88ff-be1964c27022", "indicator--119b5a9c-8994-47ac-a5a2-dc710872a73b", "indicator--7e99bfb0-caf9-42f3-81b3-8a24093400ca", "indicator--4f622078-0da9-4781-a318-a1d7dba86b1e", "indicator--12d31bd8-ae36-4b02-93b0-4c376d960623", "indicator--1a4688dd-ab20-44df-af9d-a242a8315b40", "indicator--42d89e8b-fc87-4f8b-8ec1-ee5f569d4511", "indicator--44f3c805-c9f1-4f46-a13d-918d3dac6fc0", "indicator--d8b465f5-080d-4b2c-9029-ac55c438af97", "indicator--77a22b08-decf-4c2f-859c-f4ef52a45f67", "indicator--0c461de0-750b-45bb-949f-7ff3c59ccb9b", "indicator--75fd7599-c89a-4f74-8661-87a00008a233", "indicator--407968cf-a755-4199-a809-ebf9621c2147", "indicator--2f76c550-1a41-4f0d-902b-55c1eee36ff5", "indicator--856b2666-9bc8-4d5b-8bc1-bfb9247fcd09", "indicator--90b4c571-641e-4c38-ab95-d533e2d8f51b", "indicator--15014991-f8c0-4441-a866-f2bcc1e2415d", "indicator--d3ae3713-edc3-4e67-9c0c-8615e953f1fe", "indicator--6d95566c-c219-4cf4-ae69-ae2b3aac878a", "indicator--ab07366f-94f4-40d3-807a-ef8dfc32710e", "indicator--5e90538f-4076-4ed7-ac2e-008578c62576", "indicator--0a2e6a60-ab6d-460e-8df1-d2520bbbaeb3", "indicator--c117e53c-542a-4ae1-8bf7-2033cf2a6f9b", "indicator--9cf278db-61a9-45a0-b83d-8d6e5fa17834", "indicator--6f23b295-4a2b-43ec-a35c-e694426f7d88", "indicator--b1f75a38-04f8-4404-b32d-800acd0f72a9", "indicator--996a0099-0215-4be2-b824-ea918bace576", "indicator--cf1c9be7-903b-4677-b42e-f025b832787b", "indicator--a63f61e0-4a46-42dd-b28f-8e2cfdd6b6c4", "indicator--c6fb9cc3-852f-4f00-996a-5a227e67d516", "indicator--ceac4f59-c360-4d99-9c6d-7379ef138cac", "indicator--fa6f7ba0-6402-4e7f-8614-11e962c49315", "indicator--2b555e07-adec-4548-88c6-634761c220f5", "indicator--e4447313-20fc-46fe-b76f-284127803a6c", "indicator--d15803ed-b618-44c3-b4b2-44876f5d3542", "indicator--e88f7b60-202b-454c-bb36-3f0e5855be85", "indicator--6e7feb82-cbac-4574-a001-b6839250ed27", "indicator--52300f42-deac-4d0d-9061-58b75357b2e0", "indicator--a944d7e2-de42-4838-bc66-4f08eb623866", "indicator--45f236fd-c045-4561-a60f-46daf8792a1a", "indicator--290dd6eb-91d9-495b-891d-16d703f877b2", "indicator--fc0c8b5a-a69c-497a-9042-3dc9d8de9351", "indicator--ca29fb66-5165-450c-a4ba-71e0784fe935", "indicator--f709da58-da0c-4d5d-9a24-bdea9be8d0aa", "indicator--0c8b816f-f6a0-4a86-9f98-97810d06d810", "indicator--0ed45840-e062-4d15-87e8-3eabe822f5bd", "indicator--acc7f6b0-0bcf-48e5-94fe-71135cfb070f", "indicator--4e5baa87-af5d-443e-9604-0790a6a1fa6f", "indicator--cdb4cd1d-0471-4f39-893b-f1ecd0d9dcff", "indicator--9217dd49-26d5-4d83-983d-a72b14228b31", "indicator--7a6cd69c-e38a-4954-9439-8d8c68cb249b", "indicator--c8b39c70-8ddc-43ec-8e69-d67e0f19fff4", "indicator--4bdf26a7-1530-4dd1-bfae-62875508a27c", "indicator--5a645d57-7e99-4dd6-bb77-7b532785c9c6", "indicator--f91ff412-d631-484f-b0e5-d1056ecfebae", "indicator--e09dbcc4-ec11-4796-bec4-ebe5e91da21f", "indicator--896bbed4-aaee-49c7-bbb9-ec9aeabfd74e", "indicator--f4a08d01-c33d-4c16-a23d-b69196d1add8", "indicator--3dda23fa-aa56-44b3-a72f-1abf256f6042", "indicator--376d626e-50ca-475f-89ec-1f746f0dd6a5", "indicator--b5298173-3825-4d19-bf86-75d356a6a142", "indicator--240bd14b-4692-4e0b-a901-a6deebcaaa80", "indicator--f18ee197-b2ac-41ee-a5e6-d109046a0d0e", "indicator--4485f69a-980b-4da4-8b66-160dfd4722fa", "indicator--f9e290a0-acf4-4751-9298-3adc3c24a861", "indicator--0ce3ce04-6260-41b1-9ad1-a8cec47c8d6c", "indicator--a2276dd3-c804-4a8c-9ef1-5467e1a8bde1", "indicator--6191845c-182d-4696-9d04-498915b9228a", "indicator--a34cfba2-20b5-44bc-8623-0dc9f92a6fa7", "indicator--0fe3a8f7-60d2-4f63-80c1-c3e98c62cf3c", "indicator--afb49d05-2310-4730-92a0-f45a8f610e7d", "indicator--95c56f73-485c-4754-a6b9-589b97e18bae", "indicator--9da2e558-2ec2-4512-8366-a41300accc0b", "indicator--d16f4b12-a215-4445-9b6f-809908488502", "indicator--94af07f9-d321-4a3f-9502-2865c8862d85", "indicator--9946d2ea-6076-49ea-8836-d2787bbfc182", "indicator--926f0278-762b-499b-a696-3a8e6a5c89cb", "indicator--468fd63d-83a0-441f-a488-43da84d10aaf", "indicator--16924528-dddc-4615-be84-58540ef3d580", "indicator--e9d3d819-6305-4383-9356-1f2c768404fc", "indicator--62a83afc-3309-4361-a531-90fe44f9d4d1", "indicator--55d6c47d-b1cc-4737-aef2-979946c1d2a8", "indicator--9f4ed4de-c9e3-4785-a947-81a95adc260a", "indicator--10086d04-4096-464a-a3e6-707efa71671d", "indicator--35fea427-1e48-48c1-a74f-7b5e6e725789", "indicator--440f483a-9222-4b1d-bf21-fc51b19cf7e2", "indicator--4842225f-3efc-4a38-a417-e8a17e7d95d8", "indicator--d36ed26d-61eb-403b-b2bc-ef3090a89942", "indicator--ad498371-d1bb-49ed-8a81-f955df85f0bb", "indicator--c2ceb2ee-be8b-4504-a7d0-0b92ddd3ebb9", "indicator--1a29d70e-b461-49c4-8c54-fc2e53b08605", "indicator--dababc19-18b8-41fd-9e49-415f52b2f6be", "indicator--abfc4989-244e-4318-8629-8028275c34aa", "indicator--6a91ebd1-1ce7-451d-9d41-cc517a0e340d", "indicator--95b219ad-b8b4-4bbe-9997-2dd939817eaf", "indicator--8b288526-8eb6-4313-8b80-f8699538e872", "indicator--a9e9e14a-142e-4ec8-bf21-5e2d54aa0886", "indicator--5750b2fa-f0a0-4454-8155-74513a2aaef9", "indicator--5fe8b779-a569-4100-a42b-5b97d1289e79", "indicator--19e31aed-a589-4217-8dca-fe7958db081a", "indicator--0398caf9-1156-4dad-a0dc-61cb36bbf0ef", "indicator--25932184-0f17-4e70-ad89-899dc15a6bee", "indicator--72bc7fd1-bbbb-42e8-9d4e-abed0704944a", "indicator--01de7c97-bf4e-4b12-b2e7-71583a66eccd", "indicator--b37d51a2-01a3-41b5-a221-f1fcbd7d94d4", "indicator--02937370-ef4a-4f93-9242-713d3e04fa39", "indicator--01ab0d9a-ce04-4d2f-9682-c08632c84881", "indicator--429caafa-8a99-4b3e-8690-ae766e90355f", "indicator--dfe87352-e21c-44d9-bbdf-23a05d0a94cb", "indicator--ad7e43c4-51d0-41a3-abe2-fa8e68c05ce2", "indicator--42c5aa0d-d4ca-488f-820e-07b2d1ea13e1", "indicator--9abb2766-1333-4ab2-b04f-5d15a8ed7db2", "indicator--de8e81ca-5f47-4ac0-9abf-50acfe88d6b1", "indicator--82123b8a-76fb-4f39-b2d9-ceb8d578cfa7", "indicator--89753a70-9574-4692-a213-58656f980f0c", "indicator--575c21d9-6e3f-4dc0-b2c1-aa59e3dd9d70", "indicator--84a4bf4e-25ce-4686-8921-09480df53398", "indicator--074b21b3-8056-438b-b149-2300a95cd8ee", "indicator--03da707e-09ca-417f-99ca-a75b5668295f", "indicator--9538fa51-8cc4-4853-848e-6ef2cb556840", "indicator--ddbdd1f2-6793-4e6e-92e7-6210805cfc86", "indicator--74ebe6ce-210d-4e56-b159-2d5f07b97c6d", "indicator--6b0b1944-bb07-4b6e-af2f-845325ec7bb4", "indicator--6a633dfe-b291-4a66-9f78-3ef0a173b62e", "indicator--d4c3c2ef-13e1-43ff-aa32-45d49fb38cb5", "indicator--60eeabdd-3bbb-49b9-998c-d0a429e1f77a", "indicator--3215626f-db73-4056-ad70-117b573b919d", "indicator--42812c33-df54-4ece-8a8c-9e3032b1477b", "indicator--a9c057e2-1dc8-42b9-876c-f3cac8a565ba", "indicator--634fd2be-b650-43f7-a554-430b023613ad", "indicator--22fda037-ba9c-4c30-a37b-79dec3501062", "indicator--3c715ac9-870c-4132-8890-773c70ae5278", "indicator--de239ace-915f-409a-bff2-e187a2797887", "indicator--b3dfc9ed-d824-4dd9-a673-a3c5467d6944", "indicator--db730885-e535-4ec3-99e3-dbdb82a8b2f2", "indicator--a6eadc70-9883-426e-9328-59a7a964e70d", "indicator--c85e7675-c473-4190-9408-9ae1a382f58f", "indicator--81beef3a-57e8-48a2-931a-f349089b7c43", "indicator--ff59b6ff-7fbe-451e-ae3f-bb0790aabbbe", "indicator--e53eaa6e-491e-4f61-8e73-9ad1a5d9520a", "indicator--d4a9e69b-182d-48ea-a4a8-f45db20e863d", "indicator--f432a9d3-17aa-4e30-b6a2-23c9f395ba85", "indicator--d6ed2898-f761-43b3-80a9-3437819b3684", "indicator--6db1e3c6-00a6-454e-b66c-e4c365ac26c2", "indicator--40b36693-b290-411d-a46d-e661086bfb17", "indicator--61fb3e33-afa8-42d0-8423-77e2a902a621", "indicator--0a9df23e-f683-480d-b616-c7e768af6ad6", "indicator--88f688c7-dc2b-48f2-8438-3001c925d316", "indicator--57db903c-6abf-4295-a2d4-55a1b52b14ed", "indicator--b4d12d2c-9e61-49c1-b3c1-28a117c006d6", "indicator--dede613d-96fd-4c6f-903e-d1e4bb01a331", "indicator--315ea5ed-ac31-497c-a85f-4a1aae5be8fc", "indicator--b0fca92b-9483-4c20-b4ff-932115c38593", "indicator--5d7a8854-3236-44b2-bf78-63710e583ad8", "indicator--3cb690f9-f3b3-4a5f-8f7f-c7a5c366f49c", "indicator--f99dcee8-64a4-470d-b171-909129b9f411", "indicator--0d9656f1-0233-4378-a926-ced94b722754", "indicator--6237d1bf-b597-4bee-8ac0-708c62bf4313", "indicator--6a406135-0e9b-42dc-afc7-51ed3c78cfce", "indicator--08fe6522-262e-4333-911e-6a9fc1c17be5", "indicator--8785cb4f-62e0-43b9-8101-e5d7bfd11f94", "indicator--48f1a093-6cd8-41c3-92ca-f95b191a8351", "indicator--412aa352-2893-4454-8b7e-4de3756ee933", "indicator--d1ff7945-b34c-4595-9f97-64393527e35f", "indicator--9fe830d6-641b-4d7d-a195-079cb8373324", "indicator--c9ae688f-ec3a-4674-a03a-b3ff4c30bb4a", "indicator--4acaadc5-46ef-4072-8da2-e38af364321d", "indicator--60801923-e9dc-44cb-96ea-7f3ca7a04f48", "indicator--3c5f1f5d-9429-4c33-ae93-5ca94eec264f", "indicator--fff9443e-b4c0-4cd8-8297-b13ac9f330b0", "indicator--a2d93df0-1024-4797-b4d8-ff13567a8358", "indicator--0c303c2d-b9a8-48ee-8671-6592f04c28f5", "indicator--2c21ec9b-3fc0-454b-b5c6-191f77034f6c", "indicator--e455162e-a906-425d-b323-5b94667060af", "indicator--80e74be5-ee28-4345-8ad3-10653bcd42d8", "indicator--f340a7dc-a39f-4e8b-90cb-bd11b5a99114", "indicator--32ddf223-0c24-43e6-9dc9-820a928514a9", "indicator--4e5f65fe-4ca0-4f81-b545-f84205188756", "indicator--c125ff89-a85c-45ba-9ccf-919224fb6b0f", "indicator--fc1a750b-9329-4ff9-a966-00e4769aaea8", "indicator--3e513544-5230-4e7c-be26-e6b17c21d2d1", "indicator--484aed03-a69a-4d64-9c22-eb55739e9392", "indicator--e0382ff3-1729-413a-81c5-4ebb53eaac6e", "indicator--5597f5bd-2907-4df6-8ded-98df54853230", "indicator--39be47a6-0062-4b5e-99a7-87b3d2eb16d0", "indicator--f014b127-614e-4014-ab59-5ed101809a3e", "indicator--f4681b81-76dc-4453-b78c-3808e676526a", "indicator--365db797-9e05-47e2-9dee-ed88768dbb66", "indicator--7c9e03a9-43a2-4fee-bc7d-4650067c8b41", "indicator--4cc19772-4fbf-4b37-ad80-e52f80142e61", "indicator--15780ac0-e723-43d5-8cb2-cfa19655ec77", "indicator--ff4846e9-67b9-4109-b026-2f54e373ea81", "indicator--8b621b0e-059a-4475-b8b7-b4a16f30ee0e", "indicator--f068bf07-de09-4433-a83e-ac9aaa16a5d5", "indicator--835a3db8-1895-4af6-916e-40688997b2eb", "indicator--de288124-addf-4c4b-bba1-afd217d97dc2", "indicator--36aad525-3dea-4ee4-bcc7-8e088f7c0fb9", "indicator--10ec975a-0c9a-4e34-b123-9bebe368e406", "indicator--1ee54329-06cb-4812-af10-5758f16db121", "indicator--76eb4814-df36-449e-aff8-a67eb09cce62", "indicator--ecec5b7d-7b04-4da0-a29b-9b75e244d409", "indicator--6d815abc-b26c-4924-a10f-70eeb32d8e37", "indicator--6c85ceea-15a1-4eb2-888c-746ae15c9123", "indicator--a1949c8e-f201-4fe1-9c80-2e19e0aae78e", "indicator--91aad7f3-427e-48d2-98dc-8f1301477cbe", "indicator--6b5f638d-6750-4b7f-a478-96ac5bab8265", "indicator--d620eedf-8a50-4538-9d82-dc2ccc1563cb", "indicator--f3b63ab0-1f33-4646-a665-4f3e3aebf351", "indicator--47e250c5-759f-465a-aaec-b28487ac388d", "indicator--81429af0-6309-4850-a0d2-d544f4cf5f75", "indicator--09d6814c-bc38-4b43-ade2-ade61e2efc61", "indicator--cc61b2c3-5e56-4d79-9f60-943dabb29243", "indicator--437aa213-ee3f-43a4-8c0c-af5ec8d2f761", "indicator--c366aa39-2162-41c3-b73f-2799ded339bd", "indicator--59b7fa0a-5034-4d0f-b7ff-a0cde627629d", "indicator--28018ab4-a1eb-4684-b4e6-a1d857d03bb9", "indicator--9381e3f8-a80c-4a4f-aec1-06732d363ce0", "indicator--fa6a5830-c226-49d5-bf9f-9b5c0271d402", "indicator--eaf79d0d-0a2b-41d7-8970-1465a96dbc53", "indicator--25520c30-7dd2-468c-ad8d-baaa5f141ec1", "indicator--7cc90a97-afac-4aff-ab6d-86837c82b180", "indicator--e9f47e44-483c-4e36-92db-105edd196e82", "indicator--e79ef9bd-c577-4b6a-a052-5b01bc49b64f", "indicator--1edee59f-3bc0-470d-9996-1688557d2c18", "indicator--9335add7-d7bb-4988-bc9a-0cff4262c376", "indicator--5a910959-8a4d-473d-a299-89b2b747277f", "indicator--df4f9fe5-8a94-4d81-8594-920718b27a13", "indicator--2baafcb2-e7e5-41a0-817e-cf8f72af9257", "indicator--973b759a-9ec8-4697-ac5e-b48c155ce97e", "indicator--53007b35-bca4-4499-bcc2-70177341070f", "indicator--64c6ccd6-b8b6-428c-9cf8-5cd14c44b39a", "indicator--bfa57a61-2de6-450b-b8d6-31cb8670a634", "indicator--6acea98e-f7f5-4870-9ff6-a704169bc317", "indicator--07f06fa2-9b9a-46c3-b09e-8c987bc7cd01", "indicator--f10642f8-8bd2-467d-84e0-74f9ec742bd8", "indicator--4c3bd783-fa2c-4e31-977a-ff9a662b5fe1", "indicator--2b7e3c51-52c4-42b6-9c53-a3305b3586ea", "indicator--e22ef891-b3a4-462e-a3c1-7d7fbdd36792", "indicator--d24ade4e-fc3e-4ce4-93a6-6a72b463ff0c", "indicator--b689ce2c-472c-4bbc-92b8-fa7e355007f0", "indicator--7a0e8e5d-6499-4dcd-a114-6ea463cd3b5e", "indicator--17854d16-1f52-4a3d-b5aa-7f06986d50d4", "indicator--acdc30d2-1d09-479e-995d-0e5bd91a28a5", "indicator--7b0888c0-bff8-4933-958e-7e8842e77e14", "indicator--2ad8efff-0a38-4aa2-aa03-2b82e6b83aa3", "indicator--abfa0a38-ada8-4614-a3d1-dd6316196226", "indicator--07040054-528b-4143-bf54-fecffac8a1ab", "indicator--ee4c68e5-7ef2-4d8e-9a1c-a0e0207b5cba", "indicator--293e219a-feab-4e61-afae-44fc2ae8e9b9", "indicator--7a8fee0f-7b06-4ea2-acbd-64f9c3f4c0b3", "indicator--c9cd4f5b-c3c0-4cf3-a2f8-d800dc227096", "indicator--9610474b-10e2-49ff-83d6-c9683e8fd5c7", "indicator--ab9e6c72-6601-415b-8133-8df85809d604", "indicator--8d3458a0-6977-4236-bf46-e94e1edc5a02", "indicator--8689e719-bbbc-4f3e-83bd-145f32ec8c4a", "indicator--667481b7-9314-41c9-9878-4b2da97ab47f", "indicator--4e33760e-7503-42e7-8ada-6437383bf558", "indicator--e6af8efd-43d6-4b24-973c-cc863b8c7478", "indicator--0b261e19-b5b5-472d-abb3-b4492dbfd628", "indicator--757b8d2c-4b3f-4cee-b2d6-2d9a98af8eff", "indicator--b9a55a69-10ef-43b6-8382-915821b8ea82", "indicator--ecf6395d-d176-4e5b-8555-ec8b0e0b46ae", "indicator--97714922-7a97-425f-90cf-c6ca3b78b4da", "indicator--c37237c6-c48c-4405-ab98-70ac3a8242ec", "indicator--a4973cc7-7610-45d5-8448-c9bd0fae150c", "indicator--279aa1ca-b4cc-472f-a710-e2e6956e4c25", "indicator--29f15e2d-bfd8-4f35-bdd9-7f8c3060ab04", "indicator--d037620b-d0fa-453b-b581-4e94ecc8e6fd", "indicator--73bda2bb-7c83-48d8-8021-872631a6a348", "indicator--49e58a23-db7d-472f-b778-6296383809c4", "indicator--b3d3fb06-45ce-438b-91b4-d963399bb71f", "indicator--95107081-ded9-43f0-bcbc-8baf57ae4614", "indicator--3e72ddd1-8b2b-43cc-a10f-855d52749de9", "indicator--a245cfb2-a6b1-404f-9ea3-3b362a930963", "indicator--434948f7-5a22-4a62-9358-51ede5800c38", "indicator--26ad723a-cbac-41df-84aa-6c4c62eb80f7", "indicator--74a15333-6cf5-4743-a307-99cb8ba305ef", "indicator--a7be8fec-1eae-403a-aed8-577b1270b9b4", "indicator--cd7c78b5-cbb3-4ed7-ae0f-d689ed69642b", "indicator--52767911-aee0-46b1-8fb8-b11740993cf9", "indicator--49eb90d2-4735-4a76-bb58-68104da47d6d", "indicator--9176f82f-8f70-4df5-8a82-9c3b977394a2", "indicator--b6acdee5-1b71-42fe-889e-3db99a68fe67", "indicator--69f4a9ed-1835-4a67-bc90-1cea89f3b9a5", "indicator--e270e048-0d1b-4697-9981-2efb63f85504", "indicator--ceefce0e-9f34-4a81-8f25-9e1b62326753", "indicator--e672fe83-64a1-4b1d-8dce-0109cc3a3d23", "indicator--60600d8f-d08d-4087-9898-8d1d17a8539b", "indicator--01a2574d-de78-4f85-897f-d4e7e7707e0f", "indicator--6c2fe0aa-4492-4cf7-be0b-aab0e0ac41d8", "indicator--199d5887-070f-4a74-9e5d-b25e7adad742", "indicator--92ba1db0-0c90-4f31-8507-f0b7b7e54430", "indicator--345e96fd-566c-4c17-b415-3a8038e6e69f", "indicator--e315fd85-55fe-44e2-a7e3-799fad2dcff1", "indicator--7cc69140-0ce6-432f-b904-f36cd2a1951d", "indicator--a66fa1e7-29f9-4973-901a-0fdc0380ce3c", "indicator--a9d64573-e8aa-46fc-82e2-3a45129981b0", "indicator--522bce82-39b8-43d7-ac68-1c89ee98d5f7", "indicator--244f0ee2-723e-4116-a37d-9ad8f1b9c12e", "indicator--0b0ac3ae-4f84-4c88-9b91-7665abded309", "indicator--7a645957-7b17-4533-acb5-88b5fdf46ae9", "indicator--16aaec90-d677-4f7e-b44c-2ebeb770ea9c", "indicator--46f05ffd-f3c0-49d1-a153-99c76318750d", "indicator--fcb547bb-ea46-4289-8162-36861ce07714", "indicator--35cbaa3d-69d1-471c-83de-51f6db574d0e", "indicator--db706fa9-a6e9-4f46-bf4e-a480eafae405", "indicator--715a91ad-665d-4769-a068-63c685c052e8", "indicator--f6858f13-47aa-48f6-814a-94fc3198314d", "indicator--6a53165e-ecff-47d2-bc05-5291606bddb9", "indicator--38ae521f-283b-4036-b703-9c320d32f3bc", "indicator--946f989b-fdf9-4deb-addd-7755546da9f0", "indicator--cd064515-e899-4b83-9b84-318fe78a8a49", "indicator--94abd5b8-2a69-406f-9a1f-9edca681ad70", "indicator--2919e362-f3ed-43a2-ad1f-a107e2dc7e65", "indicator--ca004e72-91f0-4129-8321-3b5369fc8366", "indicator--a5290f07-4bad-407a-838a-d73338748612", "indicator--58f1bf89-349b-4d7f-a726-a2d3eecb5af8", "indicator--59e766ad-4d17-45f6-99dd-5b93082a3c6e", "indicator--ee754175-9238-42c3-b968-77aab64eff9a", "indicator--9127a256-632f-4524-9169-db97c50e4872", "indicator--e170e748-dba3-46e5-86fd-93caf77b5f48", "indicator--f72b9e33-c5f0-44ec-882c-0facccff60ca", "indicator--4f4cf553-2e3e-45df-82a8-9ab1169f36af", "indicator--e7221a24-69d3-4c54-a0c5-a5ee7a9756c3", "indicator--586ad61e-90f1-4bcc-b786-05340f04b9e2", "indicator--b8b57d37-bef6-429a-8f97-392f744fc73c", "indicator--4df0eea8-5381-4920-a7b4-3b9e0dc9a5a1", "indicator--975f3280-f3e2-42b3-8330-8171d462dcba", "indicator--816501ae-ac44-47a3-8fed-83f50990ff75", "indicator--6699c217-6c63-43dc-aa3a-2bc8444cbb61", "indicator--82da4d97-eb1c-4081-8061-73f0b3d50523", "indicator--d44badbe-ed6d-4abd-835c-686ba089d19a", "indicator--14b4de79-afe2-48b0-abc0-2c74cea886e4", "indicator--98466405-3c4e-44ae-8aad-dbb83d46fcee", "indicator--cf136638-32a1-44a3-a732-844f909cc3b0", "indicator--6ab006e0-13a4-4558-9904-7e2f466e009c", "indicator--ec29e4a9-b742-4187-8523-e6ff9d585130", "indicator--ff543ba8-35b4-4ec1-ba04-29ff6d829da0", "indicator--06967d1f-e78a-4334-b71d-25f617419d62", "indicator--46743dd2-fe08-42fe-8eb3-d7530b6894f4", "indicator--76366620-7954-4600-9f69-c281352264fb", "indicator--a2cec5b2-fe87-488c-a1b3-9a4508e246f0", "indicator--f1cfadea-3342-46fd-aba9-be79e48c90fa", "indicator--adb3f678-08d9-45b0-861e-621c11f4b794", "indicator--010da0e3-d48b-4cd1-9838-b6e24f3424a9", "indicator--68e7c814-d6be-4a27-9f87-08699ae70775", "indicator--4ae48a10-9270-4601-97dd-6371fca1851d", "indicator--014d8350-e963-4d77-b040-61f0b5896819", "indicator--f51b8ae6-3653-4e29-b837-4da06707981e", "indicator--17e0c2ce-336c-4fd5-8c4f-84054dbe2b6b", "indicator--955b9491-1b8c-4259-b1b0-7e56eead34f9", "indicator--0bd5a472-bdc1-4367-850e-faf495cf3556", "indicator--8535e8d0-fd40-468f-be37-389bab8a342c", "indicator--6bbebd4b-8f58-40a4-a2c9-a4626d8fa0f3", "indicator--1b875ada-3370-4026-a44c-6d139b16805e", "indicator--74ee1ff5-cbca-4b8f-9d31-118a81d68651", "indicator--2c0daed7-ebd4-4b29-a02c-4ac966ec952b", "indicator--3dd8eaad-2b26-42f1-a867-329186518f6a", "indicator--a7efc4eb-7bf6-4496-97f2-0a7b6c3fe9fc", "indicator--799edf6b-d944-4861-baaf-1c03da6fa8da", "indicator--3678529c-4acf-4046-b2ad-54827166abba", "indicator--59005ab6-c094-4d1b-9507-623753035258", "indicator--5787ac62-591b-4d1e-999e-5d7a99c1979b", "indicator--05a5638c-c10c-418f-bf8c-7ff9ddcab44b", "indicator--38bf1d8b-b016-4699-9951-f9f9f783e940", "indicator--3a105b69-c410-4ec1-905a-acd36aa7ee57", "indicator--11229e59-1128-4897-a58c-b89afdc05e15", "indicator--f9bcd55b-7132-405e-a104-8de9601450fa", "indicator--080186d9-56fe-4ea2-8fe2-5b0cbe8d0906", "indicator--df31ede7-619e-4c08-bfb2-78a9280013fc", "indicator--dbab3c6c-9cdd-483b-9087-fb24a2807dee", "indicator--8074681a-bfc9-4811-b5a3-3f00bdd0973a", "indicator--c120c216-8b71-4bc5-933d-65bfbcd75596", "indicator--09291d2e-7025-452b-a804-f08db591d11a", "indicator--82e44a7b-cfad-4cbd-82b3-a281f8732f23", "indicator--4c8e9fa8-5abe-467d-a14a-17afe1d93966", "indicator--d9c260a9-34bc-42ab-ab4f-9a34275f72fc", "indicator--35daa9bf-54eb-4c1e-a3d2-ad5baf6b06cc", "indicator--9eaf8710-4989-44cd-8a0b-43d8f47bfd27", "indicator--d7c95ec1-0794-4ad3-b424-5335a00c8ca1", "indicator--5897af15-d9d6-49be-a56a-2142048d5ba8", "indicator--9c0aa248-3e73-4567-9f1a-a0b9a50f92ba", "indicator--dcbaa49b-30d2-483c-acb2-bf63e693203d", "indicator--1d2b2c46-7d85-4a30-92a0-9df9cbabe060", "indicator--4b613dd2-bebb-4ae4-b033-f76685bd4a4a", "indicator--bf41cdc4-ebed-4588-989d-c03659bad52b", "indicator--0a3382e0-d285-46c9-9072-5908f4e6527d", "indicator--da7389b7-af96-48dc-9bae-f700216f066c", "indicator--32d2cda0-ed46-434b-bca1-d71fce065c0e", "indicator--5389363e-55a2-430c-af33-0e8fd16f3ab4", "indicator--b7f2f903-050a-4360-931f-aa5026e86cf7", "indicator--23eef671-2b4b-43ba-bd7c-20481a82e6ef", "indicator--68d6a54e-3d30-4db0-bc95-a7caf16579eb", "indicator--fbb179ba-9f4c-45fd-9e97-e79559681c81", "indicator--5115f906-cb1c-4025-99b9-6f72d54dc96e", "indicator--333dfd72-fdc5-4971-874b-0453b6555b96", "indicator--639e9f44-7d5b-4d1a-9eb0-f012987004d5", "indicator--1b7cd361-c12e-495e-85fe-84716e2fbd87", "indicator--e86c0bd1-8878-4d38-a749-2f8366c5ea45", "indicator--aa64b457-6c91-4b5a-a5f2-844904b6abfc", "indicator--347eff51-599b-43e9-b1e7-0fc661151e27", "indicator--a76e855b-ad28-4b9b-a4c1-12bb42115f77", "indicator--8ae20cc1-fa95-4aae-86ce-95b6f5ea4226", "indicator--df3b990e-bef2-4a2a-9a2a-14d10c18410a", "indicator--37c3a9a3-3d15-4abe-b501-afea008d39fd", "indicator--aa54166f-035e-40fb-aff8-65423840b652", "indicator--e813f48f-818d-4cb6-b22d-ec40aeb37e16", "indicator--9e1e8211-cf14-4276-bfa8-12c67c4a92f4", "indicator--ffb70033-b1b8-406c-b42a-bf0e5f532f39", "indicator--040d2a41-767f-4ad8-94fc-cc9091d47560", "indicator--b591896c-3dd7-48bc-932b-ad28640eb941", "indicator--4335b8a1-d84d-4a09-9333-6dbd942402d6", "indicator--71680750-b1a5-4b01-b311-296b2438bc9e", "indicator--c74a5821-9a85-49d6-a3ca-f37a99a2f70f", "indicator--c011882e-62d0-434e-9400-bfc88a5a45ee", "indicator--f7a03557-980a-4c5f-a6c9-471458051407", "indicator--c39a2cb6-ffa4-409a-9976-8c012a97b5b8", "indicator--b65e290f-2137-4021-86db-4e06cf164b58", "indicator--63c8fe9d-37cb-4b1e-b849-545fa35cd4c2", "indicator--19c75a5e-a355-4c7d-a2ad-15de7b81ac9c", "indicator--0de2d690-4474-4c57-a7c6-fd3205d6c472", "indicator--791b8c99-1681-404c-9986-650bad3c6714", "indicator--852813ce-7dde-4a9a-9e99-5691a3e83551", "indicator--cb561c6a-c915-4f5b-af6c-ab21f427821b", "indicator--94cfa9c4-6581-4301-a0d8-adcc29454903", "indicator--69a89460-c42a-4783-9ffe-31f13d993e4a", "indicator--75cf463b-86fa-4c94-9baa-90b102aedec1", "indicator--98797b78-ca9a-4d5c-b519-2cdc21e24956", "indicator--749049a4-9a3e-4bf8-99e2-a067d8f2d8ea", "indicator--57dacc47-0196-41a1-9ce4-ec069b33c480", "indicator--f5bd5e04-0379-4b87-ab21-7636b9bbbdb5", "indicator--00b98f8b-224c-423b-9edf-bcac53e519b1", "indicator--a432efc4-8878-45ff-8935-a66b7d048868", "indicator--b0eb1645-672b-41e0-86ba-6936c17231b5", "indicator--23cdcddf-ebc3-4020-b64e-63dc68a0bf24", "indicator--b59685c4-d9e8-4df4-b298-6901b6cbb051", "indicator--a59c5607-6b00-4797-88d8-dd34e48d4e1e", "indicator--500e0ca2-fd59-4a5c-bd93-e2433d81d002", "indicator--cfb291ce-0527-404c-bb72-c0fac8c81853", "indicator--27a570be-4d15-4c66-b70a-c2f77909b271", "indicator--97cfd7b8-7963-460d-8978-93c12963300f", "indicator--77955a93-0898-417e-acff-f60cbcba25c7", "indicator--60c9c471-4a73-4290-9e69-b1ec0d86f456", "indicator--f0fdb242-049c-46bd-887b-ff60b19583bb", "indicator--fb89a082-57df-466e-9556-9a624eb99b52", "indicator--3ccf8ae5-9aad-4f0b-b12f-14e1e7a08ff0", "indicator--cffdf215-25b5-4bda-bb31-2974da74ab35", "indicator--e4ee6bd8-616f-445a-9664-fa55db41ab76", "indicator--b54fd5fc-3a34-47a7-916e-48c325b94abe", "indicator--5c3aa416-cefc-4d05-9456-1153b1b1679d", "indicator--b1deba8a-1e5a-49c8-a947-6b2001091a29", "indicator--fdffbbe3-dacd-44e1-9c3b-2c95804abd9d", "indicator--e89fa90f-77e5-47bb-8626-ccdb31d67228", "indicator--a1eb27bd-57aa-4989-be8b-08d75781c5ca", "indicator--aaab4b25-6ebd-4a7b-b8ed-4f3aa43d2074", "indicator--caca74e6-61e8-4a37-a70c-c0fe46c4d4a9", "indicator--f3e637d7-bc14-45ba-8bdc-69eab94b2462", "indicator--063ea47d-5e97-433c-99a2-fefc10b1440d", "indicator--29a77710-8e30-4093-baa2-5e79a1539c68", "indicator--6505ceeb-039f-47df-aeff-cea026e5b88b", "indicator--fe069878-0661-43e4-a766-095d36f47037", "indicator--3faed274-48ae-461e-b724-41aacb65b668", "indicator--de681699-2926-4a74-bb12-03d7785f08cc", "indicator--7a5a307c-2f8a-48e4-84cd-cf8464b8721b", "indicator--23606eb9-a4f2-4062-ad3d-8da481d81fc3", "indicator--a1556d34-4467-4e7f-b3ff-baa7da9668e2", "indicator--e057d225-233c-49c7-9990-f3863a32fec1", "indicator--947622fa-5927-418d-955d-b4302e8bbd33", "indicator--c4f2bb2d-a0a1-42ee-bbed-82bc45519b17", "indicator--681f63d5-09d6-445e-b44e-2065f829b5a5", "indicator--d0b00ddb-df95-4814-be8b-7004695b6656", "indicator--da595531-64de-4d44-962f-cd53f9fd898c", "indicator--9fa03e30-a6af-400b-9cad-94a18b9d6e98", "indicator--e1642bfb-f782-48b5-8671-986bc7277c94", "indicator--b7016edc-3e79-4569-9e24-5cb883f630b8", "indicator--96c97829-f129-416d-9aee-28bcf747bcb6", "indicator--75812ba3-0d68-4a34-a122-30e28499bff6", "indicator--fcc3bb90-f3e7-4167-8bc1-04508b0b710f", "indicator--f846f39f-5662-46ec-b8f3-940e8683d9fd", "indicator--acda3f3d-01b2-494c-8f5c-728541cfd15d", "indicator--2d18c4ef-0f33-4f50-83ff-d21ab7c018a8", "indicator--dbeda1c2-e646-4e09-a0f8-029fe35fcd63", "indicator--cf46a694-4c91-4efc-9599-0344d1061394", "indicator--09c74626-7a9b-4b12-af7a-e7b46520ab0b", "indicator--589f2586-c89d-4b02-a092-16adae12642d", "indicator--33d62824-1c7a-45ec-91e5-69b5cab5558b", "indicator--b11d3fae-de67-4a4a-b246-35a57ed63269", "indicator--b7caafa8-95ba-475d-8ef3-9d8813e5614d", "indicator--bb69824d-b154-419b-aa65-fbeb0689a050", "indicator--49626b04-6a8f-4bad-8d83-f3dafe17f7b9", "indicator--bf904f72-1ebd-4f54-bd76-0ee6ad15bbf8", "indicator--cdbbf40b-2d76-4142-9716-ebdafd18a36d", "indicator--b4fd540f-83d5-45b4-aba2-472b27f22aba", "indicator--80794109-b0f0-4dd5-bb03-e4a774fb06f0", "indicator--2d4ad4ce-0c33-4122-8bde-bd629ce3bfd8", "indicator--af264fbf-faad-4936-ba0c-e464fc2bbb01", "indicator--0ba32967-2b50-4ab1-ac52-57eb77a918ff", "indicator--d577f455-01d7-4753-b7c9-ed4dc4c0df73", "indicator--354697cd-aeb1-4f55-8eac-8139edec39a7", "indicator--efc86e9d-20e9-4b7e-859a-c1dc01a42e17", "indicator--616e6dcd-3f08-42a8-a55d-f6c7e7eb6fca", "indicator--b80c5a93-c9c7-4043-989f-d40b7906b50b", "indicator--17043c9f-7ec8-4f03-aca7-841fab6bffaa", "indicator--0c6e7d43-b006-412e-a485-a89f134baab0", "indicator--4143fa5d-a330-4472-ba72-dd28e0578dde", "indicator--e9c211f9-6d68-49c0-be10-059163dfab6f", "indicator--8292322b-460d-460c-aa68-1e6afb530504", "indicator--294fab36-9674-4c10-953e-4444d907030b", "indicator--4d9e4b7b-11ff-437b-b50b-2655f3eba391", "indicator--a32a78b1-22da-42d1-b7fd-c75a4031743d", "indicator--a44a1049-2335-4f15-859a-3c7b484817e4", "indicator--eb224e23-8cfc-446c-a9ed-499f93bc783f", "indicator--a1498f2e-11d3-4961-8a57-78a74a7f2e79", "indicator--17cf6e86-ba21-43a4-a7f7-3fcfcd09c058", "indicator--0a48d922-4617-486d-857a-5b19994b67e2", "indicator--bcb62890-d26f-4029-8944-30aea546ef45", "indicator--58d44723-3ad0-4ca4-9fbc-5292c159321d", "indicator--1a2e3cd6-319a-41ef-806d-7b5e7b79cb11", "indicator--65449c85-a557-4b11-95e4-e67915e82252", "indicator--de00b4b1-f47b-4788-a7ac-2c829611fc6c", "indicator--a4d14203-5cd6-4ab1-bb7d-285388d2a05c", "indicator--f2bec189-31c7-475e-8303-7a8a1c058c2f", "indicator--8168a3ab-4a36-4a41-97af-cdd97af175e0", "indicator--44e7f071-d049-49fa-bb5f-5d966b2b970c", "indicator--39cc9687-3737-4d6d-801e-32135761facc", "indicator--24c90b0a-f8d9-48e3-a179-03ac0e4b471a", "indicator--5c904b7b-55e0-480b-81a9-77aed3269690", "indicator--3d6a94b4-193d-4858-8691-2d1a2bf98d52", "indicator--bfc0ad69-22e1-4db7-9fa1-bc996422efee", "indicator--65b83e9a-6406-4ddc-8d03-b7d1cea3c5da", "indicator--1a9e8f93-c72e-47f2-ad3f-ca5f324e92d1", "indicator--c94aba87-2d16-439d-987c-73f30f3c4572", "indicator--1e9db45a-3d16-4283-83f2-e68c48e9a42c", "indicator--575c4d01-77d8-4d13-8ad0-2cbb60e7a005", "indicator--a4bbda38-2219-4c30-be7b-62f9fbff1e28", "indicator--ba1c8243-68f0-42d9-a8b2-49c7eeaed474", "indicator--4e71dbf2-3d26-4a42-b023-5e23fb990b99", "indicator--a9f6541f-37e1-444b-bc21-0cf37e248879", "indicator--5d039d28-5019-415f-8bac-5f22e85d6667", "indicator--f1496467-6e71-468d-b5a3-3fd07660ddbe", "indicator--f66ee9f2-bf23-442f-b848-ca9ce8575c66", "indicator--9e7142fd-f52c-4c41-8483-56a35df4aca8", "indicator--ec56e9f9-d064-483a-8355-26e99e8276e2", "indicator--95aef1de-655e-45e6-a1f4-70b1a52d6212", "indicator--a9ed1f17-886e-4175-85e5-adde343586ba", "indicator--cbbcafe9-7e6c-43ea-bce8-8e8f45eb040f", "indicator--7614a05a-ace0-4e0f-817c-c7c9f579ae05", "indicator--3ff7b0c6-5680-4ece-aaf3-8634d2bf90e3", "indicator--b2908524-3cae-4f87-8b52-113a1d9e7f84", "indicator--31d80673-247a-45ea-8b00-47e1a22d43fd", "indicator--ebfcd9b9-9dbf-419e-bc83-ef45ea1d8a06", "indicator--84bb03e7-7710-41a9-8909-41b6b0c32e0b", "indicator--9c1e10a6-a48b-4b53-a33e-9716106a5c98", "indicator--2f602920-cdcd-435c-acd0-7ca5c5d27ec2", "indicator--8b9477b9-ccef-4077-8b12-b94eebda39d0", "indicator--732a6380-0623-4a16-b561-691ee50ceff9", "indicator--2f5f8bd1-bbe7-40d1-b980-466578dc77bf", "indicator--1d8e3bd2-a49f-41d9-89c4-8cccb53eee49", "indicator--7fdc1490-faff-4c5b-a930-b3d886d821e2", "indicator--ba7f93eb-fec6-4aa6-8974-2e2f6222a077", "indicator--ecde5795-ae05-4afd-aebe-b095f9b53ff4", "indicator--71c6980d-9a00-4349-a7c0-7d2eb23e6d76", "indicator--af6b44c8-0304-4ac9-8f80-ad564e9d049f", "indicator--a3bf1fd3-e7c4-437c-8b31-4501744844fd", "indicator--463f787b-ba31-4d54-96b7-83542e342160", "indicator--e3d93ec9-4692-4117-85d8-7f98413857d1", "indicator--8744721b-8e65-4df2-b099-42506dde1a87", "indicator--2884c984-b7b9-4bbf-a2de-463321ca8006", "indicator--27422970-fb4e-4c68-8922-26b9341cdd84", "indicator--e20be5ca-89fb-46e2-b986-2095286a41b7", "indicator--06ca0532-e109-42cf-babb-b4ce4e94cbcd", "indicator--ad1b60eb-54e5-481f-b941-4cc7c61dc554", "indicator--ece11f31-e0eb-424a-813b-527b4d98a985", "indicator--23086fce-8d9a-4852-806c-3c48a377293a", "indicator--6579ab2d-2be2-4e94-b613-227f4fc802af", "indicator--fc15e20a-7d58-427d-803f-28f235c69e97", "indicator--52d73792-70c7-41f7-bc56-280ceaab444f", "indicator--8a702cf3-8bf9-45f0-8afb-4831d28a31c8", "indicator--094b9ae7-e42d-4a4c-8feb-e9e2e0d3d2f6", "indicator--35815a0d-d7d0-43e5-bdd1-9cfc3c4528b0", "indicator--b5b5e627-479f-4731-865e-da17f002812f", "indicator--baad1aa8-4da3-4e9a-83c9-fa2fc8fa84a3", "indicator--e351e5d0-71e0-40f5-87fb-a4cf09832a19", "indicator--b26b1fee-89ba-42d2-a3ea-0a08cea019b0", "indicator--b4256146-3567-4f3e-bd61-6726dbf01f8f", "indicator--c9b8cbc5-5cd9-48be-b154-512d58cdb72e", "indicator--da8f89a5-09be-4f52-9762-b3eb4f901929", "indicator--1e9bcfbb-e1e3-40f8-ba28-1a782ac0a040", "indicator--8f372fa7-0fce-40c6-96da-7e6b6e6b31b1", "indicator--8dd6896c-4d21-45c2-ac9e-cd6acf5ff4e9", "indicator--7162527e-8828-469c-a10e-6dea814acce6", "indicator--f80e7145-08a9-45e2-b94e-0f1fedeb90d1", "indicator--0e73da31-a3f4-4099-94e7-8c672935eb0c", "indicator--c3730d50-b309-4455-82d6-1fceeb829f7c", "indicator--71aaff62-f748-4b8c-b414-971d8d1dee44", "indicator--449eadab-7d63-4eee-b2f3-921a9c8d0255", "indicator--d620ed54-91ae-47d9-8a2e-c3fad806f117", "indicator--9a1ef33a-7e8b-42b3-9ce8-993c0d271946", "indicator--03c0fa17-27c7-4f2c-8ba5-289c552f8d5b", "indicator--7c28c956-9aad-414e-b721-f42c52dd23f6", "indicator--11d945f4-afeb-4f32-b9e7-ba8b5005186c", "indicator--cd38e0f0-20d4-480a-9834-0abe50120c71", "indicator--27b14763-540b-48dc-8575-94a0dc68670a", "indicator--98d40017-0718-4d10-8692-df42d896a102", "indicator--0a453170-98d2-4aca-a8b4-5b08c09c5a5f", "indicator--b51598f2-2595-40f1-a7ec-171b3d076e96", "indicator--c8650972-935e-4cb1-bc57-cf95c7ab8e2e", "indicator--e6d6b7f0-1e26-48c5-8c3e-ed8a2a2f499c", "indicator--eb5dc126-aadd-4eb0-9007-18269d7cfa92", "indicator--1c8056cf-f11d-4945-a2a2-55f76f1df9c9", "indicator--4b50853d-5fe1-45b0-8c67-c69a659bc1a9", "indicator--f9592ae1-4164-4548-8f20-53b154a15cb9", "indicator--dfe697df-66cc-4cba-bb8a-a91f4c534da0", "indicator--66f2c985-1d1e-45ae-988b-c6912ed7dcb6", "indicator--9b4164dd-c488-458b-98e8-fd4d34078912", "indicator--3d84b5c1-fa5d-4fa7-bdbe-e72fc834bca8", "indicator--e8585ad0-8164-4660-9266-fd10ff6af02a", "indicator--a030a0f1-64a9-4df2-a18b-10e4e05d0660", "indicator--e012afc7-193c-4567-920d-e376e96e5b31", "indicator--7be03108-ff47-4e9b-817c-7e18c846847e", "indicator--652083f9-dac8-4af6-8030-ade2a716884d", "indicator--4df3e7d8-c580-410b-bb2c-a7713d6b698e", "indicator--154ca367-88c8-436e-9c1d-b2ae194a9041", "indicator--4ffdb528-0cce-433e-82aa-85c711f6f7ff", "indicator--6c1a3226-48c5-4e29-ba6d-134ffe21a3aa", "indicator--e499bd2c-0434-4796-9a79-15003f943e21", "indicator--a08f8925-ffa3-4402-8683-369ee3d4e8a7", "indicator--25293030-4a16-472a-aa35-3c22a5127e5b", "indicator--92ae9d98-afd4-4a92-bb24-db9ab531619f", "indicator--cc716c75-f37f-44c9-b9e9-f86b8d7b063e", "indicator--237a3346-a17a-4c0a-af69-f1221a18e027", "indicator--f8ee2e5f-213f-494b-b547-877d5120ae96", "indicator--150ff082-8feb-4bba-8ba8-cfe2ac0b081c", "indicator--663e2daa-51f8-4d69-afdd-8b21d6cab6da", "indicator--e0ad2f78-7842-44ce-a93d-a00456a51a17", "indicator--540bf710-86ab-4223-8d32-1b0955edb0f8", "indicator--d7017d33-1b59-4e16-abde-902d5fa2d29e", "indicator--54c0bf54-df96-4f07-8966-8058291383c3", "indicator--6ce1c9c3-5d5c-4461-9002-7a43f12dee14", "indicator--b40d8931-1133-419e-b9c4-cec9d240f975", "indicator--7ebe587c-5086-4caa-a0f2-7e90baa04245", "indicator--d3ca2907-13d8-449b-a7c5-ba2b13de8c7d", "indicator--ceb0d4b1-7f24-4559-8d44-7223332c835c", "indicator--77a978eb-07bb-4f3e-ab94-395feeaadb74", "indicator--a46d5266-63f5-4841-822c-5c0739d7d2b0", "indicator--870197ac-8972-4d68-9aef-95b7ef5b4006", "indicator--42b43bd5-4354-4de8-9f27-bc068c645141", "indicator--ffaf0c6e-b282-4875-8e3f-6e95b50bdfea", "indicator--86ad6d40-58a4-4d16-961c-17e704f38f14", "indicator--6077d32e-fe47-4e0a-8504-a2ff92157105", "indicator--880f6761-c0ec-4def-80b9-3fbb44a0d19f", "indicator--d1a6b0b5-f829-4e45-9c1e-d1599fc77501", "indicator--79eac7a1-ba52-4a0a-b084-37cf48f345d6", "indicator--e951a390-01b8-4edd-896b-df2da9deb399", "indicator--88d0b1aa-c1df-4aca-9602-5fec4275f96e", "indicator--ba4552a4-6d63-4421-8faf-27dfd95d3841", "indicator--2c5e6f7e-183b-4239-a443-7325073435b3", "indicator--88783a85-6ccd-4ff3-beb4-f52c1e3e361a", "indicator--0b48554d-f522-454f-9cee-a79a0ff43b7f", "indicator--fbc20256-9f3d-46e7-b6e2-65134c631163", "indicator--28f405a0-326f-4ec7-a79c-7b485bd84461", "indicator--d356f3b8-2da3-4a13-ae4d-9f0b2f138dcd", "indicator--e383c3e7-b8da-4c8c-8eef-6a8ddc1c768e", "indicator--18961c88-dd47-446d-8c4c-d2590c0702ae", "indicator--083bb99d-f958-48b7-9d30-ff0a1d9a7e30", "indicator--14e01fb5-755a-4adc-9afc-2d1fd71688d1", "indicator--dc7756f8-9202-42ca-8641-d68513c42ef7", "indicator--64dd5c84-7c91-4893-bfa7-94ec789990d4", "indicator--d7c97809-a320-4484-b1d4-8a1850ae6d5f", "indicator--04b33f67-b4fe-484c-93d5-66d90992da38", "indicator--b468ec6b-3609-4abd-9ea9-eb7c7ca9455f", "indicator--c053427c-36f2-4560-af8d-65424568d5e2", "indicator--0900ded3-c692-48cf-aa30-78c13e68edda", "indicator--5b2d4ce9-19ae-4ef5-b996-c8981e49b6de", "indicator--cdd7f15b-b1df-4287-875d-b3e765c76b4c", "indicator--4aa45ea9-1302-471f-9d0a-19a098b11686", "indicator--de15b6bf-d96d-44bd-bb96-e323655531aa", "indicator--ac67d4e2-947e-43bc-8e1f-898150127b90", "indicator--1fbf6fda-f346-48b7-a307-26500fe28552", "indicator--0100705a-a4ea-46b1-bff2-6740491dfbcd", "indicator--2e6e57b8-d523-4567-abf1-634e1790685f", "indicator--86c0fcf0-9f27-452e-9c65-ec5cd395df93", "indicator--d9e2fb33-8bb0-43f1-be15-66d9fd9bdf21", "indicator--8e8b5b44-b0fe-471c-982e-e08c07139260", "indicator--1052c418-80df-4288-b9b3-8c6df41a4d82", "indicator--8b5c25af-cf10-4eaf-822c-b812c722dfc6", "indicator--abe62d42-1418-4356-9b26-a22800e8403a", "indicator--351e2775-b9cf-4d15-870a-1c48674fd459", "indicator--ce360819-04c6-4e92-b023-f4841ed6d96a", "indicator--d3235a43-62ab-4355-ab2c-585db0eb603f", "indicator--2a8667fe-2e3d-46c4-ab4b-d32dec6350ab", "indicator--2d80b085-8f08-41f2-acd8-eb3daf9db626", "indicator--06dfb58e-7114-47a0-87a5-459c8cbb4e7f", "indicator--41773e79-8e82-44cc-b5fe-96bb145463e5", "indicator--de0bf2a2-6750-4ef1-b392-94ac965acd95", "indicator--f5776e76-834c-4017-b125-c8b5874e6b17", "indicator--7da6bbb2-117c-4645-94d7-b4b5163674b3", "indicator--1a59866e-4dee-4e4c-84ba-d1d9dca7c857", "indicator--930d936e-6c28-45c1-83e4-53259ec427f2", "indicator--ac14a3fe-d3de-4d49-a8d8-ce01059eb3ed", "indicator--ceb153bd-80a0-473f-a7c5-bf1b50e24dd0", "indicator--91dfc715-062b-4c14-889d-f98ebb1cdb20", "indicator--a3c756ee-62c7-4181-8d7d-f057a55b4744", "indicator--0597a6fc-3044-4be0-9098-2a1f5dc4a34d", "indicator--e2d1e053-b770-4b5f-98b9-628fe23a2b57", "indicator--64554e61-ff03-474b-9613-0d26f113287c", "indicator--75fa72c6-488b-42c5-9c77-09db3160acf5", "indicator--04259bb9-9416-4305-8cc8-44f598c11ab0", "indicator--b5ea199b-c21d-4b5b-a98c-c821ee2d2022", "indicator--8e2aed3e-de1c-4d82-b2d1-9e94c28991b6", "indicator--1eddce51-26c0-4fc4-bdd2-0f9bc6747a82", "indicator--a7c52196-2329-403e-af4a-ca581d234166", "indicator--badb0e06-0295-4b1b-9105-b551cef8aad9", "indicator--d981b6f8-5f80-4fc2-938d-9c87dd0bd800", "indicator--d4cb1d7d-198b-4f4f-abe6-edc61fa4fda1", "indicator--c79d51e8-0e4d-4ae8-91a9-b1add5c19dad", "indicator--966e59b5-3e59-4ad9-93a5-31d11b90bd9e", "indicator--3dc08c62-8ba8-4c6f-98a8-efbbf574991e", "indicator--617f5bb2-5f36-4e8d-a44b-3aecede18366", "indicator--c19d8ab7-30cc-4d17-8f9e-3577b0805df0", "indicator--ddbd7648-60bb-4200-86df-60e864deaaf9", "indicator--e4d57b3c-6ea0-4d70-95e9-1dd1948f8542", "indicator--4fb1d5a6-f13c-4858-9a69-593d773467fb", "indicator--6e720ff3-a319-4b24-ab01-82c3dc826eb7", "indicator--f7af1d56-b74b-4e4d-9e14-1c1c65c2790a", "indicator--9c667ac8-40e5-45db-90a7-8e06e3f8448b", "indicator--77de0601-6be0-49dd-99ab-cbbaf6475e90", "indicator--ec86327e-83d0-4e0b-bda5-d9bab7128665", "indicator--dd912743-6b77-406c-9fa6-d213ba0b0255", "indicator--b56c10df-b33f-4064-b8a6-dd9dcfa33290", "indicator--237ee9a8-7b7b-4c27-9f9d-1f32ec457593", "indicator--5ea2127e-968a-4dce-b526-271b62aa51e4", "indicator--34670e31-c629-4baa-921c-19d8de703acf", "indicator--df41161b-7515-4e71-9f15-cb115b5dcf50", "indicator--71351c83-3a61-4f71-b28a-2f6714e1e73e", "indicator--223f8cf6-d75c-450f-9b60-a5d1b81d8a75", "indicator--a36ab0f6-5c40-4668-8572-96f2411e6451", "indicator--8f76f9a5-6a86-4c6b-b6a5-8f9f0bdb61b8", "indicator--f5245ae9-4ef7-4615-9af0-0413d8f65cd4", "indicator--e43c28a5-3d54-4002-b651-cacfbb971842", "indicator--eccb9cb8-61e6-48ad-a2ab-72b7969447ea", "indicator--c6925427-8064-4f5b-a4d7-bad2d8b838cc", "indicator--dd0da2cd-fd00-4a76-a4e8-c0395669317d", "indicator--40826c5e-c5c2-4c9a-a763-7c3b891d6a0a", "indicator--666e5648-a384-4c81-93d9-54566fe2e588", "indicator--e95d6ea5-d5dd-44e9-a3c2-db2abad9138f", "indicator--6be7bab2-c640-4adf-9828-37288cb16fbf", "indicator--c58b19f5-48c6-4917-9fe5-6071d7d1df00", "indicator--be26cda1-4027-4b4d-b5a5-9ddf6f984087", "indicator--d531cb6a-8ae2-488c-bb1e-bd6df5f00d82", "indicator--f0866edb-0fc9-4834-8b02-5c5eb0d7a21b", "indicator--5ff57ad3-de5d-442b-8493-198144d7f327", "indicator--9b364d36-ad50-4ac1-b8db-d2d99a91073a", "indicator--d2bc302d-2c63-467d-ad8f-65440d45f3d6", "indicator--606d81d8-a5d5-446d-8f1c-dd9873be2aa4", "indicator--4e3edc78-ce68-4ad5-a9c9-f57934c05bb9", "indicator--fe53f201-6633-48cd-860a-3449bc36a5e9", "indicator--5ade7a7c-d22d-4582-9d9e-b4b6e70517a7", "indicator--b928a428-02d8-41cb-9cd2-b6ef357838fd", "indicator--71fb9b8c-0f2a-4347-b9f1-2dc791d7e56e", "indicator--f3f7fd5b-9faa-4611-8463-1d88978afcd0", "indicator--50cf1665-fce6-436a-a8c9-3717993c2a53", "indicator--231ceb9b-1733-4ad5-9393-1025dbd7fb9b", "indicator--4094eed4-4602-4c58-bdbf-f518ecb05d00", "indicator--40c1d098-c082-4fa1-9709-205839c75bfb", "indicator--68ab105f-5d9a-4aa7-b835-286c1d55b7d7", "indicator--aa29200b-9dbd-4ccd-ade1-8be2cea3dbfa", "indicator--c9397637-a2c6-47f6-8681-054653b6f2f3", "indicator--0c786903-4acc-4a24-bb7f-2c573e64be2d", "indicator--d92337ce-b637-4844-b151-95de10df6b6d", "indicator--5623dcf0-f102-4376-a385-d11d075a69eb", "indicator--75e65c43-d16a-4cf5-a205-ff821cf8bc10", "indicator--034332f4-4f30-4de7-b0c8-019458352228", "indicator--1255f13a-243b-4cd3-8c1e-6d6d6b466fb2", "indicator--df32fa4e-1014-45da-a784-f27d6e33d416", "indicator--ec1d6e11-7fdd-4615-8b69-3cf477340e8d", "indicator--8e952fa7-44fb-4066-9ba1-bbf214f14405", "indicator--0229aed7-b594-44e0-b026-c3ae403e8376", "indicator--ba909efd-4896-425d-b27b-1409a8bb66ba", "indicator--fe10a6ff-8d43-48f4-9d38-f29be5eb8905", "indicator--ab34476b-784b-4bcf-953c-1e1fc2422963", "indicator--ff7d98e7-abfc-43a1-98d0-b1569d728609", "indicator--888a3c1a-72e9-4d15-8e31-deca0147b37c", "indicator--f386f8ea-503c-4ca2-b486-1e3903d8d1dc", "indicator--836c7dfc-d585-469f-a12b-c0aff6254343", "indicator--efc6fe93-d601-45b0-bec7-ea9eae92a8be", "indicator--424c9c2e-846e-46f4-8fd6-7ec32dc8d638", "indicator--401df100-7776-46b0-8d69-63e47bb54036", "indicator--5ae92291-ceff-49e2-ae46-1707f43981be", "indicator--1f8ca3dd-06b2-45e8-8d8d-f5eadf0c33ad", "indicator--2dbd62c4-2637-4d79-9af0-7da2e6cdfd17", "indicator--db40b8e3-cd2a-4c1c-9c6a-db5b35b63a9d", "indicator--b9a1db5a-97ba-4d45-8d96-23b16d5c5af8", "indicator--71e6189f-8d51-4031-bff2-898422d24fa5", "indicator--66036ecf-1c8c-4a48-830f-60b57052ff5a", "indicator--089bc2d7-6edf-4b3f-9d28-6be49adf7dcb", "indicator--55930089-7922-4d5c-bdae-db278a1e0199", "indicator--972c68ef-05b6-4118-ba19-f0c4df5fad1f", "indicator--7172e9ec-1563-4fa3-b9be-d82c1ed91b2f", "indicator--eb27f519-6828-4fd4-bce5-abda7537d1a5", "indicator--75daabeb-5fb0-40d5-b01a-d961ace43430", "indicator--91638980-20d0-4cde-b706-aab85e9ae025", "indicator--412a3454-25f9-4df2-ba00-fba054b15edb", "indicator--cfc72542-5613-46cf-9454-310e43020bcb", "indicator--1f72db29-8479-47e7-a9a2-c76c6ec9a4b6", "indicator--b2cbf171-2201-46e6-bc76-e3192355a98b", "indicator--2e870b9e-b19d-4f49-99ae-f5f2a8ebd065", "indicator--a2b9a12e-3247-4e9b-b52a-5e99f320e401", "indicator--2cf3c82b-87a6-439f-bd44-521268adf9f4", "indicator--4b3f5ee5-06d7-49d2-b97e-111665074573", "indicator--92f8af2f-3661-4bec-9ee3-27d3f41cf9ed", "indicator--565a5456-e4f5-4b98-ac26-54b9410638f0", "indicator--36f2600b-c468-4582-b316-37b5a7c3e1bc", "indicator--b825999e-ee8b-4176-9250-b3084fbcee97", "indicator--2debb39c-2c50-4d1d-b01f-ea966f103d15", "indicator--7491923b-e00b-48f2-a30e-fcc91d9e87b0", "indicator--f7f6811b-d897-4899-b88c-dabebab25dd5", "indicator--3155e30f-524f-4499-a520-286644357cd3", "indicator--b900e6a7-342b-4950-83a8-5306da407180", "indicator--e5fbcc8b-1446-437f-aebe-0bf7896800fd", "indicator--e4a41655-7105-425e-a92a-1a03dbdbcf12", "indicator--d07cb4ea-220c-48e4-8560-f3d947134716", "indicator--957402cf-5776-46ad-99e5-8a733c12d6a1", "indicator--e2ec760e-9d38-4f16-a8da-f58e6418e2df", "indicator--42f4cccb-33ba-442a-93ad-3602302fcb26", "indicator--85c4ce83-e39b-438f-84bd-172a2acb805d", "indicator--27f42b7f-9003-41fc-ab8a-0a0a185f9cea", "indicator--6ac67bb6-a386-4efd-8551-fa7783fd62fd", "indicator--157d7aaa-04ae-4780-9413-6536f882bebd", "indicator--288cbdb3-dbd0-450c-83e3-8ac593f04cdc", "indicator--6aa4207b-d7dd-4ced-9054-121c4b47284f", "indicator--5aad9438-2742-462e-89d1-68808123e0ef", "indicator--65372a57-35a8-499e-a1e2-69b6d4009fd7", "indicator--420b71ab-2598-4bc4-8c1e-72ae7bf56a81", "indicator--b7fdf50c-1db9-4797-a748-11c2c6972c27", "indicator--0b59abea-ce8f-40f9-b73b-8fc380fc3589", "indicator--1ab3449c-104c-4e2b-be97-782004069a8b", "indicator--01a3edfb-f63a-4cd5-a807-e6016d3c61f7", "indicator--645189bf-c5f9-4f99-b694-f90f4813bc36", "indicator--79174605-c5fe-4a27-beca-7932d5d54ca8", "indicator--ddcba2df-c8f0-4f11-80bb-4ce2a7c7d353", "indicator--4fd46de6-7679-49bf-a20f-f6b2c72a9e27", "indicator--3ec6bf35-004b-49a7-b5c0-71330ad622e8", "indicator--ea5df23c-2d4e-452e-95bc-d50acd339a98", "indicator--7701b805-5aec-4498-8619-1b091c125b87", "indicator--bf400f47-62e9-4e3d-ab0d-038ea04e5348", "indicator--3918a9a4-3f1b-4b52-b414-7f3c070055a7", "indicator--5a4e7555-f42f-4a82-8a27-d2c6e7927fba", "indicator--4c471487-26b4-44e5-a20f-93d3cb63b9ab", "indicator--f7b3a148-7019-4bb4-9883-89b880680c95", "indicator--a10f6d5f-4e13-4027-89c2-2ef3079fedc7", "indicator--38538d4c-430a-4190-961c-c51c5deccd5d", "indicator--77d0f6df-53b1-4715-bcd5-24b2dc309040", "indicator--62f17247-289f-4b4d-9dab-4c68e0fc9beb", "indicator--e45a9bdd-c65d-427e-94d4-af9f2c88a7ba", "indicator--956a40ea-fea5-4c27-917e-9f73570bb487", "indicator--7571d174-8264-4b53-9ce2-91f2349f191e", "indicator--5a90bd0e-ca2a-47c2-a7d3-0e86d6bc310a", "indicator--67c3a234-bf4c-4d0b-b481-266ef59abe2a", "indicator--e8f3aa5a-4510-40ec-b963-34ea28656a07", "indicator--c0cd18d6-712a-4157-a947-22da2ac786eb", "indicator--581fac0b-1f67-4c7c-a2eb-9156553a7b4e", "indicator--21f6361d-aabf-431a-8b31-83c13b66c48c", "indicator--9b4184f2-5036-4cfe-9450-e8c8193dc522", "indicator--54800a98-5056-41c9-a0f0-3dae9194fb95", "indicator--a2f3ade5-1100-40a1-9bf9-02db21582f6b", "indicator--bced8deb-a9eb-4a01-88fc-92961781593d", "indicator--3e9f7b0e-0515-4b75-b000-ba8182ef81a3", "indicator--1c24e262-50f1-44be-b6c9-0c877641c011", "indicator--d73d08f0-076f-49ff-9c0c-15226d6bf971", "indicator--db13330c-4b43-48fa-b21f-9299d7cd416c", "indicator--95f6e3cb-c2cb-45df-92e7-577f4a301341", "indicator--194fb8f8-7972-4703-89c3-e03c736ef355", "indicator--b7beba31-3a3b-4386-961d-927ee8cfa45a", "indicator--9ebb1f42-2ea7-4468-8e37-c78b4240a9bf", "indicator--bc97b335-9bc8-4b9f-a191-d15031e9a1c6", "indicator--0c1cb63e-fd6c-4314-947f-92f63c1bf724", "indicator--297bff78-5fb5-4b45-a225-b8022125f531", "indicator--b2973c56-0819-46c2-ac08-4899d262f22b", "indicator--59ad29df-f1a6-4c32-b321-fb254b8c5281", "indicator--882bcb40-b345-4ad7-ad2b-7a77a7044810", "indicator--59f87221-0a04-454c-a485-2606e033e956", "indicator--ea2fb3af-ce16-4e54-87d0-fc7ae957ae85", "indicator--d8d4d01d-94ab-419f-a4e2-5babe89da5bd", "indicator--df9523d0-6975-4bea-850c-40cd0fcfcd15", "indicator--c9805f12-9c90-4e8d-adf8-a79b88afc5f1", "indicator--166406ee-a40f-4b25-857d-a7cca251312d", "indicator--2af74dc4-020a-411c-8f18-f3a4a1520ae5", "indicator--2d820c62-d9f5-406c-ade0-e0163544582a", "indicator--369f9ae5-bd6f-4d2a-b66d-b468985626d0", "indicator--fe781673-dfd6-4a0c-88a5-3a4133dc576f", "indicator--a6d8431c-b93c-4517-bfc1-ba7d9190b3be", "indicator--eb4f86a2-c3b0-4fa7-81b9-88eb40b68220", "indicator--15cb93a3-5e60-4c24-86e4-aee80649e031", "indicator--f7395d0c-fc6a-4877-878e-0e95256fdfe5", "indicator--b3ae8c86-ee94-4208-99de-8bd3e24128f1", "indicator--ef0c665b-dac8-4e21-87c1-9ab73858348c", "indicator--9bacddf5-733d-4c80-86ce-f32591aed0eb", "indicator--ceb164ae-369c-4b32-8084-1df30d9d7c7c", "indicator--af7aca16-7844-441c-8e35-35a6bc755843", "indicator--6c5d24af-dccc-4037-8212-aa136bd0ecdf", "indicator--fa30d9bd-9a3f-4ad9-aef8-63a600d95fda", "indicator--2b07e0fe-5df6-4109-a1bd-4cc2d088c94d", "indicator--df3fd5b8-2d0a-41fa-a7a5-c147e0f8b6eb", "indicator--cf17a6c4-db42-4964-bc1b-259d6e40f9d5", "indicator--3c58f5c1-9ab0-4bb9-ae6c-d28c0598a85a", "indicator--8ed3c7bd-cad3-4ffc-b338-83e42d0b49aa", "indicator--956779c7-68ee-4265-b6cb-f71f652ec55b", "indicator--3e367201-6de8-46bb-854e-834ff2d9e6da", "indicator--a6c4bba9-ce47-443d-8663-d678117a6cac", "indicator--3e5b5cab-ce41-442b-9c12-35114f86073b", "indicator--86240db8-de21-4f29-99a5-a1728e49008a", "indicator--2a8d817b-c842-4c13-8162-ae8fba2abc21", "indicator--95c62bbf-462e-4f93-ac68-39d98c5dd0a4", "indicator--09e70a22-9ef1-4723-8338-4c873aeb5f30", "indicator--747ef61b-b2ee-429b-a54e-06ba82485c2e", "indicator--99dd2555-ee82-42a7-a63f-10f791b38f9f", "indicator--7eb2f3ae-b0a2-441f-a446-6309d904fd4e", "indicator--3622985d-e92f-4578-acb4-08a568d44161", "indicator--6f15ddf0-5f7f-4171-a798-e955d33ac40e", "indicator--e337304e-0534-41fc-9ea0-b79dce053486", "indicator--d702103b-e0a8-48fa-8258-025a0734634d", "indicator--30e93e7a-96ce-4b16-a196-d465bce31b57", "indicator--5dc12053-5d74-486f-a2f2-733b960a1e80", "indicator--4999cbd6-da64-4609-978f-75ae20fec8a1", "indicator--ad5dfc63-0dfe-43dc-bb98-3af763f36f08", "indicator--800cabb7-326c-4b15-8714-7ea954fe045c", "indicator--53481139-dc58-4e54-b95f-fdb837535cb4", "indicator--80af3435-7416-4e37-8756-0c1206224ca0", "indicator--55bce1ce-ee1b-4c12-9c43-88d9d5f39df2", "indicator--292e0345-3949-45ea-9de5-b9b36bde9dbd", "indicator--157e9ff2-0e60-4981-bd0c-3a3fd89622a1", "indicator--b1938388-cea6-4ede-8581-ce246e81423c", "indicator--9817cd74-a6da-4a61-8ba6-edd341d8ecd3", "indicator--a795bef6-d4aa-437d-be31-9ecb6f691ff6", "indicator--e8d599cb-0a05-4eb3-b9aa-289a3575d594", "indicator--ff72497c-90f2-4bd6-9c67-736f6495cb39", "indicator--ea1c84db-f301-4d84-a53a-69a47957bfd6", "indicator--3a120582-f53d-4164-818b-25cede1544a4", "indicator--c3ada057-4201-469d-bbe9-7a1a5c8b1e3c", "indicator--8a79d398-b94b-4fa0-a03d-16af6a25dfa5", "indicator--e2c3e770-98d3-4c21-9056-c4005e52184d", "indicator--9fa1c308-0c0a-4cb3-a4e6-55f08b747328", "indicator--1edcb7b9-68f8-44bd-8540-c519c443e5aa", "indicator--bbc14b83-6c08-4915-97e8-ebb9a96791e9", "indicator--7e9c1440-8e2b-4e18-9a3c-2ef789c89f1e", "indicator--086e9eb0-fcf4-4ff4-9af4-add503026803", "indicator--d61dfa38-8f98-48cc-b023-d1671c823c3e", "indicator--c8b0c238-44ef-44ce-8af7-a8849b4a0df2", "indicator--35cfc276-82a3-460a-a007-f0a6f33b02c6", "indicator--ec3fe23f-4956-4e36-8027-244fa5649a22", "indicator--de528465-3835-4054-9114-b7671452c281", "indicator--10c20c30-f852-48e0-892f-dbedf62e3ffb", "indicator--78b50672-9201-44e7-b505-f8114b03f3de", "indicator--1246900e-d23d-4f9c-ab68-5bcfff670701", "indicator--770c9c2d-a1e9-4c03-9bbb-60d08d77ed32", "indicator--504fab1a-c093-46a7-bde2-ae17a78f3164", "indicator--0a3d7d03-1bed-4e8f-ae61-aeb261ae59d8", "indicator--2aaa500e-9d30-4cf8-b6a3-dd9bb0606164", "indicator--62219d66-35ca-4cfe-a826-249c78d505ec", "indicator--b4037790-d55e-4007-bf42-99c58ac4f874", "indicator--85b391d3-8677-4b63-af1a-3460c4ee3c8e", "indicator--d85419aa-a2dc-481d-abce-0ba1a58400ec", "indicator--dac71e3e-c5c4-4b79-a351-73730558a211", "indicator--76343ebe-d936-43c4-b29f-25ff0291ed42", "indicator--33625edb-470e-432d-8975-90123e8b76f8", "indicator--3d9a0755-c0af-460a-8349-46e87c8a4ad6", "indicator--a60c4e3e-fbc6-4e8f-8dcc-a33e5a22ad69", "indicator--ef8977be-b333-4965-bd78-36a9450924ce", "indicator--70ac89c2-01f5-4918-bf71-76e9900fe4fd", "indicator--d5b8907c-b9dc-4911-9c99-ce46264438fa", "indicator--0b5a167c-47d9-41df-b66a-22c46091ee41", "indicator--abfe56f4-db03-41d5-9d73-94ca0d25c9c8", "indicator--553d7f54-df35-4474-a5f7-9310e4e5c64e", "indicator--3bf6339f-04c4-42c4-b52a-0120894808dc", "indicator--2212811a-e62c-46ed-a47b-4b1d55bf079f", "indicator--8c7ee67f-40a7-440d-95be-bbed9018ebe1", "indicator--d2501ab7-9214-4ea0-8faa-6304f0078cf9", "indicator--72c900e6-42be-43df-ade2-a9ec349977bc", "indicator--669189b6-7d3b-4549-8c17-88b2ba0ef02e", "indicator--6fd620b7-ce5b-4907-a7f5-afafe224aa0a", "indicator--2f160481-cf39-4ffe-acfe-64c6a789bf5b", "indicator--c0e2a411-cf2c-4aae-8698-225b5cd8fd17", "indicator--49249f96-0903-42e2-a6ad-843264cc3db9", "indicator--a2cf8d48-1b09-4fde-ab9b-09d57460a9a2", "indicator--e339950a-c6e3-4207-8f78-fb7cd43bbf43", "indicator--40a6e3ad-eaf1-49e3-b6df-8ca43a30edba", "indicator--f39b53ad-f2fb-429c-abf1-1ae888b7bf78", "indicator--b109332d-0b3b-4227-8364-12484a9b5ab6", "indicator--2f648aa1-c960-4399-92fd-0fd55328e184", "indicator--0d1b881b-88a7-4ee4-8a2a-ba62ea2c5f4b", "indicator--9368169a-f77b-42c7-ae65-d42e55959bbd", "indicator--97c85ef8-a156-4075-8f12-3eeba09db9c7", "indicator--cde1b974-0fbc-4701-a293-156bbef5605d", "indicator--3c550c84-58d5-4d37-93e9-f117c5da4ab4", "indicator--e0b24516-cf02-4c08-824f-c1f1e960417c", "indicator--fa0b5eb5-10ba-4369-8f98-27b89c5d9cee", "indicator--543918cf-fbd7-4216-a6a8-3801b9118cc3", "indicator--1dbd47ce-1e46-4360-95ca-cfc444956c60", "indicator--3e9cebe7-0a2a-4788-819d-2c3a1dc006db", "indicator--496571a9-d560-4240-88e4-dc6e53bbfa12", "indicator--4231376f-3c7f-4026-b1b2-e94385086090", "indicator--a34a745a-11f3-486c-84c2-62a1dcbda458", "indicator--91dc41a5-6a35-451e-a2cc-2b0442866f03", "indicator--c6e4a580-004f-41d7-8ccd-15fb9436c38c", "indicator--66293ea1-c729-45ad-ab72-6fc8516d16e8", "indicator--7c9f2ef9-feda-4403-a974-7f32c5710c63", "indicator--0f69faf1-bb8c-411a-8213-67101c424c8b", "indicator--717b6910-fdbc-47fd-b04f-957e194ac263", "indicator--a9040fa8-72ca-4167-9721-66f9b215553a", "indicator--831b7635-c191-425b-99d4-9cf7d116fa50", "indicator--36105e41-6740-4d85-a926-e1997eb3d741", "indicator--01741114-47c7-47a4-a04c-acc3e0b0a498", "indicator--126ce028-9d50-4bf6-9431-f60fcae3fda2", "indicator--379c64a2-2bb6-4dde-bc93-763a518b4bb0", "indicator--0f4912a8-8a5d-4172-8a35-a9ea205f8151", "indicator--ee445dab-2408-42dd-8b88-27d7735c3e92", "indicator--f0760045-0fa0-4acc-affc-77a2d6a43c17", "indicator--43e03fe1-a75a-442d-9509-0c426f2be03f", "indicator--5bef7b55-97d8-455e-95ed-f97f62291bc4", "indicator--2a9ac06f-6c8b-4b58-ad8e-061acdf93c57", "indicator--6d767abc-c2ca-421b-b5a3-e529bacfb20d", "indicator--a70484ba-3974-41a1-b072-867414dcbbf7", "indicator--3e701859-3771-430c-a5f5-4a424e177106", "indicator--4b36cd11-0d08-4251-b980-1db6853febad", "indicator--9687b8b6-aaff-4366-b2ab-2c87e5481a53", "indicator--21b826a8-1b7d-4f45-b2f1-63e33488bfdd", "indicator--ed8deaa1-ee0e-49e7-9724-7c6c19ff9c35", "indicator--c26450c9-579e-483b-b289-a25656980844", "indicator--980a5910-5971-4f4b-ad82-333d0ef38050", "indicator--057559ad-335d-4c5a-9035-2107e8e1af8b", "indicator--d972f4a4-95e6-49a4-950f-121e146b21d1", "indicator--bc5fb0dc-7eee-4dc0-bd62-69a211aacc98", "indicator--5a39f6df-6875-4702-a9d1-922991153a64", "indicator--3fa4d925-5f95-4434-bc45-6ab11d45519a", "indicator--a9aa891a-0496-48f9-a61a-83406a791eb3", "indicator--11447d6c-80aa-4840-8ebd-065698bfefb7", "indicator--cd27d532-c9b9-4588-be43-0c45ea102ce0", "indicator--f4a772af-dc27-49a1-ad94-7738505259f3", "indicator--83d540b6-6408-4533-958f-03f3fec19a0b", "indicator--08cf8b3e-f784-46fe-9b8a-94c3e9861918", "indicator--21dc9cd1-f77c-4548-aaa9-be7c9dd87319", "indicator--6388241f-94a4-4763-a155-c3a701f3cbbe", "indicator--80ef04ca-6a33-420f-8952-3f16915213c8", "indicator--4d405b6b-2ed5-4bf7-9a0f-58c906090d84", "indicator--9d22f4fa-4aea-4f66-8423-2d4ed96dd553", "indicator--e7470dd3-599a-43a7-a1fc-ec0d0981dc6c", "indicator--8373e18d-1785-4dd5-a5d8-e1aae8169acc", "indicator--6996b3b5-7f37-4029-aec2-2d082fea0b6f", "indicator--ad2c21f1-b7b1-4e9b-9135-c166138973a8", "indicator--2634ec67-d141-44c7-b96d-a4a5c38cc85c", "indicator--25100aaf-bfa5-40b4-8cbc-c43d3a24c4bd", "indicator--6b5a2b62-0264-4158-acb2-30905b75c170", "indicator--5beb4453-f673-4dd7-8e31-9951eb44b0cb", "indicator--e75a819d-c466-4545-a4f3-aeb7eef762fc", "indicator--4244b673-b8b0-4b3c-9178-73b6ffb86092", "indicator--75c28897-bc97-4f05-b9dc-f367bc23120c", "indicator--d4d29222-1ee6-43e7-baee-8540c770d3b0", "indicator--798e9dbf-a818-4308-8c50-543ad1cb31fa", "indicator--1d69a2ba-998c-4d0e-96a1-31418c97ba2b", "indicator--541ee551-c077-4bf3-9a11-0502445d7818", "indicator--8616b543-709e-4e22-bd76-3953148ca10d", "indicator--1c79f65c-d96c-4e4d-8dba-0d7a9918897f", "indicator--2f7168af-36b2-49ee-ab22-35dac0adee84", "indicator--44068cae-b84e-45b9-950b-4a7c5990be5d", "indicator--68c718ee-9f69-4dea-8cba-157e45cf2f83", "indicator--884a6e85-b927-4eb5-b128-2334a8a3fbb6", "indicator--6662f280-da3c-4c02-9e70-93d02fb49585", "indicator--5437a8b1-898a-458f-8257-9cb67f9e882c", "indicator--97248120-3950-495f-8827-a031dfbc1070", "indicator--e4444129-130c-4382-b344-bfc6845fc5af", "indicator--f98c87c3-684e-4947-bb17-942a5f7acc4c", "indicator--f543afe4-b1f6-4de9-a233-e30e79f27778", "indicator--bef3856b-98f0-4691-be77-205ab5f72d51", "indicator--4a2b1768-1c56-400d-be66-9c2cd99053b1", "indicator--851b6f39-a44a-469a-8cf7-fc798bc927da", "indicator--57b82c09-a57a-4ca3-b40e-2f08c96c881e", "indicator--ce4bb4ae-aea5-4a07-a4e9-7a513e1b517c", "indicator--835fb0c4-3813-4678-a040-ff0ad76d7664", "indicator--1b55ba73-7620-43a8-aa33-484ae000c142", "indicator--452519e5-1081-479b-b49f-e88c8c5d0b46", "indicator--08d7a7de-553e-4dec-9b2d-a2eccfab1a4c", "indicator--fe4d72f3-252f-44de-86d9-25dbcf657ba3", "indicator--dadc783b-8a6a-4282-9971-cde9820899bb", "indicator--dbd26782-9af8-4ec3-8f95-1bc0df29a930", "indicator--86d28595-b4b6-4b3b-a1f2-d2b78dd0b600", "indicator--8181de87-705b-4acd-af5c-76a6dc9278e4", "indicator--8a59d2ff-972c-4f97-a56c-422dc79214ac", "indicator--38aa4085-27cf-40dc-a224-ab751bef207b", "indicator--6510ff29-0e25-40ab-8bf8-6551bfcd2968", "indicator--6c7edca3-f6d5-46e0-a3b8-0f97c8effb71", "indicator--718f8d6b-f912-4947-9cc8-69c99cc27466", "indicator--8d26caf6-d213-4146-a26e-b9f93ed98766", "indicator--d48b9939-3e57-4a55-99df-e47b11ce726c", "indicator--f225be4e-7712-4c97-85c8-df7b1b04f516", "indicator--74fb1696-234d-46f6-b1b5-881ed8a4fc6d", "indicator--1122d6e3-2e78-43ba-a7c1-12fd39cb764c", "indicator--f79eef4f-719e-47d1-a1b5-797928dcec33", "indicator--93f3a533-78ae-4a07-b7d9-88486b1def2c", "indicator--202fd2ce-c82e-4979-b053-44b7cc631ff6", "indicator--8a6e4a60-8bbc-4cd8-9071-f6f2e75bb105", "indicator--057d3161-4375-4f45-b386-a2ccba5dc7ef", "indicator--7ad58bc5-f8de-4f52-a37d-57df27f0261a", "indicator--140f5bb5-eeb8-44e1-8b52-9c4d4dcd6c88", "indicator--36bab1d3-fff4-4327-b3bd-10cabe8631b9", "indicator--5c1cf91c-725f-4774-85c8-396b508c6a0e", "indicator--d2fb8069-8595-407b-8a8d-54aa27f4def8", "indicator--ecf52262-8317-471e-8cbf-4c298e21b917", "indicator--7aa3de83-f3d3-46d1-b99a-e6af57c1a1c9", "indicator--b524fd33-7745-491d-b00f-4fca08fa281e", "indicator--72931c71-5764-43d0-b5af-3f15b489ae1d", "indicator--ca8b97ed-848e-4bcd-a065-67439e4c9949", "indicator--43e81916-e9d6-4a29-80ec-ae410c41ee67", "indicator--49d1bdc3-b92a-4f21-ad89-dc28ab85a0d2", "indicator--a01162d7-fa04-469b-b2c2-b1c93cb17af0", "indicator--a77ff3b1-ef56-4367-abf3-dcb7de1493d4", "indicator--1a6686b9-4a99-4ea6-989b-4402f84b5ce6", "indicator--a5ba495c-7fc8-4809-8e4d-495ec0b221b6", "indicator--11988057-f811-4bb4-935b-2a37ba6714c6", "indicator--ef6b753d-36c1-4368-af64-ad049ba664c4", "indicator--2fa5ac35-a5a8-4d5c-8a73-633c5d34b68e", "indicator--af34acdf-8a29-4721-8b6d-46cd564c798f", "indicator--01035c08-6abb-4b80-a681-846fb63b0d2d", "indicator--6ad012d0-b7c5-4e7a-a173-113225820412", "indicator--10fb375a-853b-4a04-ad75-f1a0a239e9ba", "indicator--fdd31c1d-ddac-4f11-af10-a7ba567e0880", "indicator--bd7a85f9-518e-4d5a-97a4-6479b62de93a", "indicator--b0077e39-c909-4180-af42-6e6fd37fff4b", "indicator--2a94dfca-25d4-4cfe-8bd5-5b6585016dc8", "indicator--b5fbf71c-fa53-430c-a25e-b209ce9b212c", "indicator--eca8b127-a50a-4b0b-9c0d-b1d06a65070d", "indicator--4f16b573-d42e-403b-8a94-81fb022d64ae", "indicator--b19c7cd5-5cd6-49b8-a699-7796247ac0d2", "indicator--b6cfdbb8-817d-4849-b199-8b01aea79fae", "indicator--f5e9a28d-b58b-4609-90f2-5c6c8b1d7b25", "indicator--f12d2bcf-b33e-4024-8a81-1e20b2eb0403", "indicator--baef1795-2a51-4871-8ee7-6dd08243089f", "indicator--85db0dd4-e4bd-4900-8054-1000df05bf24", "indicator--f06f304c-d36b-4930-9ebe-144bde5845a3", "indicator--d548f548-3a30-48bb-82f0-590eb0100fca", "indicator--5366b5c8-ec1e-4f49-9f78-498720275583", "indicator--81332d1f-078f-4a74-a266-1af0d4085f31", "indicator--4b7ec767-4442-4889-beac-ae2737f5c3a2", "indicator--bceb088a-ede2-461f-a06e-c695de339172", "indicator--4f32dc29-810a-4039-affc-92661d618187", "indicator--c508ed98-e8e0-43b8-980e-ffcb7030da9a", "indicator--b1d946e8-716d-4c79-b8e5-d7cbf36ac790", "indicator--bfbd0a99-4c81-4eb3-856c-7dd1094cc7bb", "indicator--98558bc7-d18b-4b4b-8873-b6eeb536313d", "indicator--831e26d1-4488-46b6-83a8-b02e8a796e1c", "indicator--dedc4e96-a1df-4d24-b732-9d04214f67ff", "indicator--5993de0b-dd9d-4012-86e9-eda5204f3703", "indicator--3f7b88cb-b315-44c5-a746-e7955dc5af90", "indicator--7db67744-36ff-4484-82ca-616f051a7a89", "indicator--b42f45d5-5ebc-4537-9a19-011883240838", "indicator--d6bc8866-0fc1-4201-9765-f481d0df7087", "indicator--05e02023-e01c-4891-9284-b9fb16911800", "indicator--58135573-75db-416c-8d91-659bada91d5f", "indicator--a52dc138-cee9-4987-8716-075324c22b13", "indicator--fe51532e-aa56-42df-9d6a-e1a248878a2a", "indicator--d53611c5-eb02-437d-9bd0-3ec1ab9cadec", "indicator--5b4fa0b9-ff2c-4534-bc46-d3a66dea468f", "indicator--0ce0db5a-5786-4165-ad86-4b8ed3e8e0db", "indicator--f6e030bd-0e80-4984-9166-5d9ede0e8d11", "indicator--df84f09f-f4a8-48ad-8109-994d681729f9", "indicator--d8260594-d2f2-410c-93e4-97e4921aef22", "indicator--317ca601-c289-4624-af6a-d3d4acafadc6", "indicator--09bd3803-9056-448e-b68b-406908ec5027", "indicator--1011d23b-3a11-48f6-96d1-174f56b72cd0", "indicator--89a87d13-764e-4c76-93e5-14a630735d10", "indicator--a33564d2-b3a9-4ae2-b363-080484e61b23", "indicator--bf60ea9c-0276-4528-8afc-04e06e1e8c21", "indicator--b15854a0-7ca7-4f97-b5e6-2897724bcaf0", "indicator--bb411892-4c95-4ddd-b12d-ec27ff729862", "indicator--11a7ac10-9221-4fe3-a838-31d0136d89a3", "indicator--8ddb2fd1-fbcc-4d7a-b0c8-0b8ccd3479c7", "indicator--c073029a-8e9b-4ab6-9cb2-df228fc44b04", "indicator--1f14bde2-08a5-45f7-9401-39f15c6dc467", "indicator--6e3b08c0-6da6-4870-bc92-6893a5f8bc18", "indicator--a2e42aae-3e89-4f83-b716-d6eb11d09814", "indicator--b2050f9c-73a9-49a1-ab91-2fb908bd338c", "indicator--79d0c546-7af3-49b7-b273-facd0fbeb4a8", "indicator--f8c1d6df-6b4c-45ab-8f44-0f19a1586efc", "indicator--19fe6969-e962-4802-b210-2021d0a21cd5", "indicator--88871a96-7d37-42a4-939e-cae958f37434", "indicator--64ae3ab2-0a9f-4ec7-8925-9e98e0e78820", "indicator--6cb57131-23bf-4df1-960e-f0dfc1e829d2", "indicator--402e2ba5-6a76-4f71-a2ed-cf1f65d2a240", "indicator--68c93d66-b161-4b50-bf22-a2441d0838ed", "indicator--cb65e954-8a1a-4d49-8a81-998e4e775b4a", "indicator--a715dd61-8dc3-424e-b58b-a5b9f9a6f5c2", "indicator--6e0480f9-7b09-4e0f-8f7d-55dee681fcab", "indicator--ed1f450d-819e-4404-9253-091f8fa0568d", "indicator--2c0838f6-b4bb-4bf4-80bd-fd080018271d", "indicator--7fd8b07a-1d54-4b99-a2f2-3737a1ac048a", "indicator--b38d46f2-921a-4f1a-95f1-747dfccb9752", "indicator--43d015d7-44bd-4093-865a-dc53fb47bda8", "indicator--892d16b1-9f44-426f-a9ef-252c00bf3d5e", "indicator--089c52e3-4be6-4530-afdb-51c1d4e09036", "indicator--bbf2a44a-eddb-4f19-b9a7-d3b7bbe9ceee", "indicator--b6c6bcda-a706-4868-bc0f-dce703f564af", "indicator--b8d24f00-2594-4681-8733-ce185ec0d144", "indicator--d81033a7-10d6-4560-b35e-59ca62b2ab2e", "indicator--dec2b0ee-b585-4f04-a58c-256928703e41", "indicator--55ffee8f-0bc3-4115-b364-9c74a17ef823", "indicator--d64bd035-2c07-450c-81e0-daf0d45e080a", "indicator--2a525d4b-3419-4e85-8a5e-c3d0db9113ce", "indicator--e0aa0c40-f36f-48e5-a4c9-c78af935927b", "indicator--450f8be2-6fb3-4c63-adbb-dab93cc024c5", "indicator--1eda52c1-0261-463f-81c3-502d8cc9ccf5", "indicator--82c9e185-df70-416f-a001-ebc62a0d348c", "indicator--409cc9fd-8eff-4e52-a259-4ad30b15e580", "indicator--46c14cb9-d604-47b1-b3d3-0bb0aa7d37dc", "indicator--47b5801b-b624-4bcc-a14f-efbab9f2f158", "indicator--e7373f84-6e6d-401f-9b1f-aae6c49b7adf", "indicator--18024bc5-a849-4f9a-875d-0cd49f54cc19", "indicator--3c56cdb6-3f73-4a5d-8410-ab6824e02e64", "indicator--cdd30599-c4e4-41b4-bfbc-04f6624bc413", "indicator--acf4cfbf-ee86-46af-b0de-e3c328837ee5", "indicator--d83e3fa1-bed7-405b-9442-927d4e4f1de3", "indicator--ced14d14-0403-4249-963e-935a92b601d3", "indicator--41a14d2e-e235-48cf-83c3-a178491c9718", "indicator--779a9a98-7716-47fd-9929-2137e04eee94", "indicator--da69ce68-47ef-4305-9170-6fac81a34ddb", "indicator--ea4d3721-d250-4a7c-b189-3029f0326800", "indicator--c92f2e87-859c-4483-ad5c-a93dfb81aae0", "indicator--002b6c17-3276-4db1-8829-7e46c9a2a455", "indicator--6c923337-a1a3-431f-86b2-2d72275a5aea", "indicator--0bed0334-cbed-4355-bd86-8cd0d5b180ea", "indicator--fa92beab-12a5-4316-a1c2-6fa4375795c7", "indicator--ce7f210e-baea-43f3-b788-64bc1e913a17", "indicator--65cae14b-beb5-4f1d-9ff2-222e039a5042", "indicator--ced2fefb-8469-475f-b777-05756d321486", "indicator--c575a1a5-9d76-4bf8-9387-3ee9967c6b0a", "indicator--f2fafc4a-a62c-41ec-96f5-133fa33eaffa", "indicator--9551ede8-5d52-4280-85d1-a74d9790c9da", "indicator--e0d4aa91-63ec-4892-b288-04d58f858548", "indicator--bdf83ef2-fc85-4c02-a845-cadcb4be844b", "indicator--4fcba273-906f-4bdd-8496-cc254bc5e18d", "indicator--28f0b7b3-15a0-4787-ab8d-b7d6bbde2faa", "indicator--b39dc72c-2aa5-4345-a70f-ba3b2efd4d5d", "indicator--ab15e3fb-4ba0-4811-a710-a0f4ea2980e1", "indicator--32decccd-e2ba-4887-9655-31a731512bb9", "indicator--e547d800-4be1-4e86-94be-9a217b3d343b", "indicator--475e697c-657a-41ad-9972-ca2ae3a64583", "indicator--576dd332-4385-4088-bdab-2b8999c32b51", "indicator--f953eb56-17cd-4911-8394-92bf0da33617", "indicator--6db1d2e6-fb41-4e46-bc50-a5a2e7b9d3c9", "indicator--2dd58eee-9391-4785-a79e-43e4e61aeb88", "indicator--fc63db85-82c0-4019-be51-4288723e5ec6", "indicator--c05df294-55f9-4a5f-a562-44be52092c43", "indicator--c36bd5a7-8d1d-4e70-8a7c-e1895b948f92", "indicator--edb5d23f-855c-4e6d-9274-baedaa217aa5", "indicator--47b5d07c-3397-43fe-815a-deda40d1af6d", "indicator--583c416b-92b7-43c9-80ff-5df9f90b1b75", "indicator--2140ee77-8fef-4e8a-8bd1-ca4f63d6d035", "indicator--e801568f-2ef1-41bb-bcd9-c0eebab0572a", "indicator--1dbea809-dc49-4889-99ae-bb3853e6952a", "indicator--27f4f9ce-b36f-40c9-a85c-7459c7efa0ea", "indicator--a202141a-95dc-49a9-a2a3-fad207038568", "indicator--5b1ed706-10dc-427f-ab11-fe5a8ced70ed", "indicator--8246158b-bf50-4e62-aee4-4b94a7e11974", "indicator--229c3f0b-423c-4a4a-9823-df0225dadd27", "indicator--46fb85e7-f8a6-4362-8489-d9797b79daa6", "indicator--37f4cfb1-8dcf-4709-b4cd-16f86d5d0f7e", "indicator--1dfa43cb-b3e9-4be8-af87-4b646065f642", "indicator--767f7009-12e6-4907-87a3-1000d1463cb3", "indicator--b074b529-fab4-4ef9-9453-64774efd30a4", "indicator--11ad9332-06c5-4e76-a95d-b64fe75282b4", "indicator--79a47bb8-d808-4e8b-a4b9-9c67af4153b6", "indicator--8bc63caa-b6a9-488f-8abe-323eb410bb70", "indicator--6c407d87-e8d1-410d-b021-17f1fa94e73f", "indicator--7d9c8e9c-9cca-4296-8b97-b96a34bec0d7", "indicator--cd5fdfb7-c594-4a10-8e33-87325d7f6685", "indicator--d5dd1c90-5557-426d-9a9a-4c4baf818746", "indicator--f9e9624c-b5ce-453e-b691-dd5e3d98be4a", "indicator--912fd33e-d4f7-43e5-bbd1-05d48aad2475", "indicator--a85af0d3-7ddc-4b04-805d-1441317de7fa", "indicator--79fed304-e2d7-42b9-8e47-81e4d1148ed0", "indicator--9f8cd02e-c764-429d-b89d-07b99a49974e", "indicator--0e8fdcc9-02f5-47c5-a93e-8f07cd41200c", "indicator--67b799db-d4b0-4e72-8341-2c0c2464a9db", "indicator--66e8ee4a-a670-4bec-9e5c-63760f080877", "indicator--03930a51-31c2-4b66-8d0e-b12b55cf699e", "indicator--7ed436e4-1891-4272-adc1-918178085126", "indicator--3fc4493e-b427-4f40-9f1b-59769ef9e0a9", "indicator--3e8821fb-0a6b-4902-8ea6-2f193e98c176", "indicator--48f24d32-67f4-48ab-a75a-3ae9d4c67edf", "indicator--5c63449e-2cb9-4b0b-b562-bd19390dc406", "indicator--5b16d8a6-ef97-4996-838c-cd15ad245907", "indicator--dd5b9646-8480-4fac-b3fc-15341b2e8276", "indicator--cd2b25bc-f18f-45d0-9e91-2462705714a6", "indicator--a2ae56f1-61c7-4939-b459-f39e9f2802b8", "indicator--05ee2f52-8a6e-464d-ac5d-a0b3c848a20d", "indicator--3f9baefb-42ef-442b-b79c-1d225cd16cb7", "indicator--6606ebaf-95d7-4226-b4f7-53c54c62bfc9", "indicator--b0b9b4fb-7d2c-4c82-802c-1161a75145c4", "indicator--08eab18e-3cad-4399-8f62-1d209cc1219b", "indicator--c4810512-a07d-4fc9-976c-cd2b1bf7d981", "indicator--a29c5df7-7095-4ff8-9480-246a3fac3e24", "indicator--0c6bdf50-b4e2-46f5-bc88-c0c232a7849d", "indicator--c017f8f7-ae59-427c-a030-433d59fc804d", "indicator--7945b44a-6d0e-4a76-98c0-8a48463cca7e", "indicator--3d78bb56-bb9c-44f3-a2a8-131bb3b25c29", "indicator--e53b71db-d5e7-4ca2-9b52-ed59d6b8730d", "indicator--5e7f650f-ff88-49d1-989d-db6b14e9babc", "indicator--cdbea67f-a19c-495d-8264-62111d51c22e", "indicator--3dc39ae1-79d2-4106-b783-d700040b01c2", "indicator--9d0d83de-05e0-4509-8d68-eb6226636afd", "indicator--2513280c-c556-4784-9379-a985c282460c", "indicator--ddfad475-9f3f-4e7a-b34a-397df8772ec1", "indicator--62fa900b-0d5c-4201-bc92-dd7545a2daf4", "indicator--f1d3edad-aca0-4a58-886a-01d31b0ff829", "indicator--eaa88d65-adfd-434c-ad76-8148f5fd66c2", "indicator--92158a7a-b421-4e59-b275-7681dd3f31d5", "indicator--38144fcc-daa1-4136-bfcb-f9e0f82c7c25", "indicator--f98a58d6-6173-4157-af6b-d7ab9a23a631", "indicator--55c8f1f6-7594-49b3-bd83-696e18aaf762", "indicator--b80431b9-fde9-49a0-8860-67e27042e63d", "indicator--1643676e-b068-4733-9292-44311857bc7d", "indicator--851a4973-455c-42dc-97e9-a0b251bf0c68", "indicator--18b85551-0978-432f-8146-20a04005e2a0", "indicator--1d31fcc5-daeb-4c7b-b50a-c0beb45ec199", "indicator--8004fc0e-4a21-4570-95b1-5ec8501dbd8e", "indicator--ed1ecdfc-5711-4c37-8c38-908cefe5442e", "indicator--806be357-e775-4ce9-8ae5-8975921eca1e", "indicator--5cacf7d0-7670-43dc-88f1-aa692eb24531", "indicator--14561081-fc5a-4549-8eef-3ba7432246ce", "indicator--8a5d06be-0ee2-4367-b185-e7800be52d73", "indicator--7359dbce-7c8d-42ad-8c98-3fd75fb28736", "indicator--586bdd05-92a0-4b5e-b1d5-986e90d956c5", "indicator--4abadc17-c237-4acb-b268-ed7a483ac327", "indicator--bbfcb687-a716-4eb2-aa61-fcf19c7be2ab", "indicator--d0412a57-e6b4-46a2-bbaa-acbe0d3ba3aa", "indicator--af23aec5-ecad-43d1-af37-2f861b204cb3", "indicator--361b0d78-3d04-42f6-8325-28ede0181bda", "indicator--1e5e4f4e-8538-4105-bc1f-f7ac452f9228", "indicator--6fd6d063-fa82-40d8-b99a-b4997b0b3f8c", "indicator--aa1e05fa-fe6f-4db5-bac7-9d67e4027a39", "indicator--bb00a627-2306-4192-9140-9fcad3ca6175", "indicator--e58c0e0c-7eb3-4f90-aea8-99fd5d481741", "indicator--6884a319-4bd6-4838-8140-d0d04e436f70", "indicator--7c817d2e-e460-40c1-8cfd-af5e07e55f22", "indicator--07ec5f56-d2cb-4019-9fe8-6553323dc295", "indicator--1f6addaa-11bb-47f2-b6d0-88e294c20e61", "indicator--b50689f6-4605-4521-8ace-4cc72bef0d0e", "indicator--9749b5a2-052f-48b8-b1c3-4124a0652f5b", "indicator--10d19428-0800-4477-b3aa-524f6f7fe5c2", "indicator--84ca003e-d48e-4817-a95f-52b9d339b993", "indicator--1eb35868-a310-4ec4-9954-07df3929aa4f", "indicator--0c3bc337-bc69-4347-ba13-43ddd1ca5318", "indicator--4ff0eeff-729f-4ed7-a3a4-ec93daa6f754", "indicator--0867aade-1884-4395-b543-d3e338b0a230", "indicator--a0ec9c16-6af9-4c3b-894a-8a0230b47ee0", "indicator--1f8d745a-8398-4fce-8d06-4cd80f494cdf", "indicator--fad3d463-13bf-41fc-97ea-b029a3d68428", "indicator--61a74c78-69c8-4423-8887-dcc8c503aebc", "indicator--87cfadb0-410e-473f-a734-6f9dcc1fe1c3", "indicator--d9181b9e-f499-4769-96b9-08fe9e822d5c", "indicator--4655457f-4aa9-4ff1-96a4-3844d0e49b66", "indicator--d0460e0c-3b03-4a00-9786-5322f1e82150", "indicator--b0349ea5-5095-429e-9361-cb04fc155663", "indicator--26f9084f-c69c-4b11-98eb-8a8d822d14a1", "indicator--acb445b3-88a0-44e0-b798-2b5e01d30271", "indicator--b94c22ab-a52b-44c0-a1e8-db0d6621f9c7", "indicator--b424489d-150f-43d3-b78a-19e64f978404", "indicator--c9df4ec5-5113-43bf-9c31-6fa1b65a546d", "indicator--cde22f7f-3e8f-49a8-9ff7-4fe35a463ce1", "indicator--e2e3d0f2-25cb-4d36-acde-406412c7f8e1", "indicator--cc53c785-9107-49e4-97f9-5b59675b796a", "indicator--e2bbe6bd-262a-42eb-9976-bca95d5a00fb", "indicator--f44db021-849d-44f2-9f21-7f4dbcc6ce30", "indicator--3d510a6f-8c45-4f8d-8a79-e5d7736bce11", "indicator--376a7014-79d0-4608-99fa-f09346cec50f", "indicator--feee65ee-34d0-4bcb-ade8-431a97781a63", "indicator--73a8be66-b7bc-42ee-a876-7c2e8f40172f", "indicator--f558878e-6081-4d88-92e7-297b2fc8911c", "indicator--20072565-2b6a-4076-8f07-a5845fa9a376", "indicator--b2449fd0-16b4-4100-a251-8ab8932822df", "indicator--acee6e6e-e3ed-4b0e-92bf-a79ca557fb9a", "indicator--37d1ec8b-46be-49a7-b1da-15e75aa5e39e", "indicator--61e2c49f-6e11-4713-a1c5-68092b8ed36b", "indicator--e5ae32b5-8ac8-467c-822a-1482480534a2", "indicator--d685f8b8-daa9-4112-8f44-4f7f1963bac9", "indicator--fec7abd6-81b9-4fc3-b052-4c1eb133864b", "indicator--d1a421a8-d606-4909-9bad-2bf4cf67662c", "indicator--5c558920-6166-4dae-8d22-eea345284751", "indicator--17e0bac1-af92-4f0d-b7ba-e3ba40d14882", "indicator--44aa0c98-f7a6-4a3d-8580-28595d39d421", "indicator--c0a92da9-ca13-4ddf-917f-57a326172c11", "indicator--36c80c83-a8eb-4d19-acd1-a88ceb5a8d8b", "indicator--8f7c832e-2b08-4fa8-9580-f3d6c0496748", "indicator--252f4bfb-dd98-400b-a2ac-89011949142a", "indicator--3705e1c4-0f25-4b0c-bd2e-52ef271c7a35", "indicator--70641b23-2deb-4941-aa8d-dd598e5bacc5", "indicator--d53af3dc-6f73-4d49-9620-f067163d372b", "indicator--3e5bb95c-945f-4c03-8a4a-391d514d381c", "indicator--762b7fb1-2d3f-441f-bf14-4971057880e2", "indicator--6cce9664-1140-4e8d-ad53-b5acdde4d863", "indicator--096dd418-da51-4796-9092-74b01710006e", "indicator--c0d8ce7b-a269-47cd-8bc9-35c3fe097e3d", "indicator--a26be2f8-5793-4360-a7f9-6527dea8f934", "indicator--68fc7b03-7ed1-49b7-99bf-5fcb3c484105", "indicator--5aca479a-6a9d-46eb-904e-60d8a172902f", "indicator--caf38b3e-4d45-437e-a367-eb2a5ac0f35d", "indicator--03efa5b3-7208-4950-9066-c30dbf67db3f", "indicator--5ee550ca-5016-4f8b-822f-5167e0e9e4aa", "indicator--fd61e53b-204d-45a7-8831-86600ba8d4c2", "indicator--c9942695-c9ab-4d92-a04d-ec68b908fff8", "indicator--e77ade0b-f6b5-44bd-b023-7d79ed45e898", "indicator--32363096-58cc-4b9f-891f-67ce49a5b77e", "indicator--abaa2d50-020d-419c-a9d6-0aa67daa1504", "indicator--46d7dc21-6b8d-4dc8-a54a-d4f6c1644db6", "indicator--8eaf4e86-9fef-443a-88d2-d4c2ddb94848", "indicator--e7fafcf5-8655-461d-bde0-157343b4ff8e", "indicator--41940590-c3b4-4179-9963-f2c753926adf", "indicator--7376f9e1-70be-4d41-a281-db7ac92cd3d5", "indicator--8f29ffa7-362f-4b9f-bc80-037c0d76a7aa", "indicator--f7747851-e86a-4699-aa47-61efaceea3a4", "indicator--6e2e3ee5-434e-4cef-8fd4-aeb39c60e6f5", "indicator--4c255535-dd58-4c1c-a612-4c049619ec30", "indicator--1879e18e-4e56-48ba-b3b5-acf52400d3bc", "indicator--ab427e36-5873-4ef8-9b40-339df683dcc3", "indicator--3882de03-4bd5-4580-a64c-5d4321a3b0c6", "indicator--591e0b4e-3a1b-462e-8012-caa469587ff6", "indicator--182689bf-2793-4cd3-b993-862c86e6c7fc", "indicator--601ec60e-9c4a-4120-9b53-f84ef175362f", "indicator--9bb49f21-3287-4614-9f3c-aa06b441400c", "indicator--1bb85971-d827-4eee-a511-e861435ca91e", "indicator--5fd67fb9-5f17-4458-8614-10ff0fd2e3da", "indicator--0c9c2d86-c9c0-4aa0-8f66-99895cd86cc5", "indicator--8aa35c14-ba40-4a41-b5eb-5b0954c81b3e", "indicator--43551ee5-5aee-4bee-b398-1c80ab9fa577", "indicator--96f472f7-66d3-4c72-bd54-84724ab51da0", "indicator--14925e7b-76e9-43b8-8d03-9c570ea1b513", "indicator--eb1e8276-377c-40e7-ba35-ed7a877f53d7", "indicator--cac889f4-6ddd-49f9-a482-d1c15ee1a821", "indicator--0030c2db-bae3-4ed3-a4d6-b3fc2738ee4f", "indicator--773d94aa-9a11-4ccc-9a89-90d9179c5413", "indicator--9080458c-24be-4a44-b5ec-8f68bccdbdb1", "indicator--d84285af-cde3-486f-876a-b835ea6e7ed8", "indicator--8cb9199c-ea47-4b89-b253-c15f0e259cab", "indicator--8c3c4d95-8389-4a0d-965d-9250fc7aff62", "indicator--816fda77-bb13-4e5d-b2dc-c1d2c102af8b", "indicator--fef51335-bcca-4068-b73f-22d97598fc77", "indicator--8db3cfda-81c3-4a98-8f59-586d929f40b8", "indicator--e14e87dc-12d9-426f-ab7c-1fd6caac6d7a", "indicator--58e37891-feb7-434c-bddf-c1c98a3edafa", "indicator--b1ed4c75-577d-4ccf-9836-fcce5c5378c1", "indicator--15834d3b-db8d-455b-b642-ab63447fb4fd", "indicator--f7964395-3806-4457-8112-8641eb42477d", "indicator--e00d3854-d730-47a3-af21-0dac11ff8226", "indicator--ffea8d9e-7e1e-47d2-aece-8e1c34f72134", "indicator--a3503ccb-d9c6-4309-824f-814196d23558", "indicator--3842d573-ec83-4769-975b-0caecd29ff63", "indicator--77a6c7f3-ade8-4bfd-b7bc-933502b23a2b", "indicator--76f22aed-f522-4164-95fe-2aa330ba6627", "indicator--e55ea0e6-e996-473f-8af0-ced15d37d8f0", "indicator--b61ffa1b-e8f9-4fcb-b47e-441db315b79f", "indicator--a0ce732d-80ac-4ef1-a9da-e9f423a1038b", "indicator--93755f9e-4112-4aa1-962e-07bb308adea3", "indicator--dbcc97f0-5428-4df0-ba0b-a924b5cb1bce", "indicator--c99d27d0-6d01-4013-b38e-fe375495f456", "indicator--b7a6212c-a7e4-49b4-a82e-83fe9ef12c60", "indicator--da2cf5c9-b39e-4df7-9a1e-e0eaac123457", "indicator--b5c0a304-ffe2-43f5-8131-30cced18fcec", "indicator--57c32e01-313b-4a4a-8eec-27024c55a643", "indicator--9786a8dc-e501-45ae-ab98-214d1096e066", "indicator--a72021f7-eb6c-4824-9067-67ba0828e5ab", "indicator--237e525a-ddf2-4a44-a720-2eee8cca12f3", "indicator--6f28e6d2-9f46-4d5e-b856-bfc263f96f42", "indicator--ba03a1f0-d3fb-4eb7-bb9b-73e596806eb2", "indicator--f9dda6db-b4ed-4bff-b9b5-5ccb1a2efda5", "indicator--8541f9d5-af08-4078-9221-ceb778fd2b55", "indicator--de0da111-d190-4e7f-b9fd-92d2505a0b30", "indicator--67d91e7a-eb36-47e4-b1db-fb9f76231816", "indicator--4c5a7b3e-a51c-42f4-bb5d-4cbb625ef11c", "indicator--8daaf89f-437a-4fe4-a530-63139d485e32", "indicator--567eec96-a1c5-4eca-9ae9-268acc7de474", "indicator--134354b1-3fbb-48bd-b2bc-1c5423fbc19a", "indicator--206385e5-3319-45ad-b5a0-ea1af7b58493", "indicator--2b307bc8-d76d-401e-b0c7-684e03d2f350", "indicator--8283aaf0-1ca5-4b35-b00f-1b7c0883a074", "indicator--d89484ee-82a0-4263-9102-414eedfef203", "indicator--220ccc61-b883-419c-9842-c5bd073b3eed", "indicator--d32b48e6-a275-4ce3-9ef7-32fb268b169e", "indicator--855f015a-2d24-4ae0-8b86-b38c23a6bf21", "indicator--5185d186-2b2e-47b1-b1aa-4852f986260c", "indicator--984e1570-758b-42fc-a5ac-af780e52fbeb", "indicator--b91218ff-467b-4112-bb9c-de3581511ac7", "indicator--9341d640-00a0-412c-9c2b-48dab7af9275", "indicator--28c88a9c-5cb6-4a16-bead-e8e207c63b38", "indicator--42536166-cacc-4e20-90a0-424089674922", "indicator--7e6b9394-4e45-44a6-8d9b-6ca65cc779b6", "indicator--3fc3b6ae-24c8-4209-b4c9-1f98bbcaa8a2", "indicator--cd1dbc6a-e499-48f9-9bee-392697b9b996", "indicator--b24744f3-967e-49b4-baf3-eb19c61b08a4", "indicator--988695b1-9a48-423f-8c18-9b518127788e", "indicator--171d80ea-3691-426f-bb42-9293e04cdc4b", "indicator--7d88cfac-72d6-4cd8-8450-fa6c93b206f4", "indicator--6ad7186a-5d45-4bb6-82b9-57292b28cb77", "indicator--02523104-692d-476b-877d-a489595913e1", "indicator--4c612e54-9c47-40f8-ab27-5a4702725a7e", "indicator--9a077026-670a-4b24-bbc4-0d7d43c88aeb", "indicator--d703e249-d856-4557-8e29-d736533729a9", "indicator--59c454da-aad8-448a-aadf-98134d3cfba3", "indicator--9444c78f-5e59-45e3-ada2-97ad6a566e42", "indicator--957f7355-1045-4731-be70-c9cfc7a5a15b", "indicator--c2a67ad5-28b0-46e0-a4a3-10bdae2dbe07", "indicator--979b46c1-d5c5-453a-9560-835a4611d798", "indicator--59c09794-4d01-4454-93fb-22c8aa7fb17b", "indicator--70777da3-79e6-4021-aed7-bb7c93dcf78b", "indicator--c9c5b739-3e41-4f77-8867-f4a7caa846d2", "indicator--f784ba61-2bfc-49e5-8497-09f09862eb3e", "indicator--defbef61-2f2e-48aa-9e28-722f432fcb77", "indicator--0d3a5af4-2237-4b15-9710-d022d3bd065a", "indicator--2825ab7e-72bc-46d0-8bde-26ea51f21e30", "indicator--9df263e3-9a4c-42c3-8a31-f7926f9ab810", "indicator--63afeeea-fb91-4808-8f24-54b62a7464c3", "indicator--b9abceee-2e80-4350-ba0a-ce8a4ee468a0", "indicator--cb8cffe8-a261-4022-b7df-e8d6a536a7d1", "indicator--0eaa8f6f-69ca-46b8-8d21-20fb5be49e43", "indicator--fa4d2274-916c-4e28-a054-edd9742a97b4", "indicator--452871e9-a97c-4941-a966-6f39065c2ddb", "indicator--bcc4d183-fa9c-4a07-82cf-7332144c1925", "indicator--db74bb74-90ca-4203-9cbf-5502ab5c2aec", "indicator--53b31fc3-1db3-4ea0-a203-a7189e4f0d9b", "indicator--12fa7ed7-87fa-474d-880a-2645a42be3d0", "indicator--eed248f3-34d3-4677-811e-328f0a04ad5d", "indicator--25c19f20-a2c7-4750-b480-9017a737741e", "indicator--90870c99-d9c5-44fe-8513-6f920167919a", "indicator--482f4ca1-916b-45ef-b73b-7e07fc23e821", "indicator--ce998b31-3975-4358-90f6-0c899155487a", "indicator--20645768-91c0-4053-ba42-56459d8c22ba", "indicator--ec5a3368-2f2d-4071-8f69-49f73d1b9061", "indicator--c7c1db9c-51b2-4f9a-86e3-9e94cbcb62b9", "indicator--73213ce7-1df0-4ded-836e-093d4b486691", "indicator--59279241-0bda-41f1-9d8a-2b3f351f69e0", "indicator--03715777-1702-4fb3-9368-e9473ab690d3", "indicator--edf29abe-5e91-43e2-b155-ad0983a96486", "indicator--03b8a73e-441c-4298-a463-7207ea7e16d7", "indicator--4b0e714e-740c-496c-8bac-c1f851dcd39f", "indicator--d6ea6737-a9f7-43da-9646-773c415b3e13", "indicator--579723d9-e3e3-4136-8360-eccef5867fdf", "indicator--ef5fc880-4775-4e3b-8870-225e1fb5995f", "indicator--d1b68a63-af9c-4c40-8b91-cbf2abb56802", "indicator--9b457fd1-3b79-4f16-a69f-3bae4a0be4d5", "indicator--96d04828-c2ac-4f42-8455-d6d1d8f0c2e0", "indicator--15dc010e-07c3-47c7-a83c-590ddff20a70", "indicator--62a2fe1e-3709-4719-956e-f59c9cf5f932", "indicator--c9e95617-8bf9-4dca-923e-6b9131d4d166", "indicator--5dfc0271-cf86-4ac7-a496-b9402d68db5e", "indicator--0daad5d5-a41d-4367-8ce6-bd385e72b0df", "indicator--8b4799e5-0b3c-45d6-bb59-01c52fcc40ed", "indicator--a9df15da-ca39-4780-9d1c-9043f2607876", "indicator--546c4b20-d493-49f6-889f-e1b74ec966c1", "indicator--915001b6-2a04-4b7e-9862-93ac7b3d90a9", "indicator--68eaf841-5a91-4ef2-8ac0-b0331e692cc6", "indicator--f94f8980-2bcf-4787-9610-c4b05e57fd3c", "indicator--641e410b-89d3-4aeb-9ee5-c5543abbc692", "indicator--024dc756-f14f-4846-9e1a-7e7a88f11a1e", "indicator--aebce6e3-0bb7-4027-ba9f-94baf269ff38", "indicator--72f59719-af7f-4609-8a0e-d557f60fc842", "indicator--a7741d04-6fbf-4c3b-a962-76714291f3d8", "indicator--7b16b637-9c7b-4244-aecc-9605e23f9cea", "indicator--2942cbe4-e6e9-439a-956a-7218c2a5cb5a", "indicator--5611ac52-47a3-4a1b-a095-f8ea4f74ac60", "indicator--aff1eea6-ba09-4329-99fb-7193ac6113b5", "indicator--29ebce87-6492-44e7-8621-78ad8be55090", "indicator--42cde192-da06-452d-9c3a-7f38a9e68389", "indicator--69fb43bf-288a-41e1-a82c-5601d7fa694c", "indicator--ee4a9f8a-8564-40b8-a09c-960b2ce4763c", "indicator--fa04aa67-b425-4409-9e5f-7e3134a49e24", "indicator--734e86e9-9725-49c5-9125-8d3ff3178d97", "indicator--fe9e0f82-a7d1-44e4-97a4-64dd173a061a", "indicator--fc7f9e89-1a2e-498e-a7b6-6d3af83b2e9d", "indicator--7ed85164-e374-49a6-b7ea-db0e7d993d32", "indicator--488cae05-d057-4fe9-8efd-85b394517d89", "indicator--44d9555e-d192-4996-a2f6-dbe46d03a43a", "indicator--9af0a759-0da8-48a8-8dc6-2dfc15309b86", "indicator--74a408c0-21a9-4e06-994f-db69a44b19a3", "indicator--e975826a-8a92-4f45-9e5f-06cf1868f5d5", "indicator--00a8575a-c696-49ea-9c2a-9faaea101060", "indicator--f50b96ee-1058-42e8-9f17-19ea2b34ef2e", "indicator--d765e03f-2f38-4939-b1b5-1e60c558f024", "indicator--45ff0f49-daf5-46c8-b67c-378044dc8895", "indicator--9a223273-7291-4184-8bd9-120c1f0c7f9b", "indicator--95a09071-4002-49f8-9eec-080c529486f4", "indicator--39796470-64c0-4aad-8720-1b0c4189ee19", "indicator--f8518c2c-a656-40f8-bc98-fbed32f10e04", "indicator--f95b2db1-4531-496b-a1d2-72ac94ba9f09", "indicator--8324f0a8-604a-47a7-9707-7962efe22d9b", "indicator--00f2bb12-1e28-4ce9-894e-15678bc3fdb4", "indicator--e7745584-703a-4e53-9330-433246261034", "indicator--d3ada730-a2e0-4291-9eb0-19a96221b241", "indicator--db589e61-e3ab-40f4-a5cd-b7ab2e0a1bbb", "indicator--719e762e-f991-4375-a480-a3d9e57c1ee3", "indicator--637aaf99-3dda-4e6d-b8c5-0de024069441", "indicator--be89a87f-c2d6-48cd-a5e9-8d59b478cdd7", "indicator--157083ef-4754-427d-86c8-b1d4e7e98da4", "indicator--d5c48c9e-ee8f-4966-9953-d3ac3a68fef9", "indicator--2e4ff509-5292-469a-ab01-63a0712c21f8", "indicator--50a02043-2c45-4c5d-80b0-473da06e7d9a", "indicator--5ddbe416-8b63-4369-9810-ae77f6b96433", "indicator--6ab6964c-d640-480f-90f9-295b4f1af9e7", "indicator--7b996ecf-695c-4f59-9a93-62b37340a4b0", "indicator--883b52c7-b271-45a0-92ac-42661e98d1eb", "indicator--6fadc886-1583-4827-931d-94439bf3136c", "indicator--2cd4a41f-0503-41d2-85a2-2e9986707fbf", "indicator--58399a1d-3bd6-478f-82a0-2a1467febabf", "indicator--098bd1ab-148a-478f-9965-ee660b9380ca", "indicator--6133a4bf-23c8-482a-aacc-d0c24cd30608", "indicator--93e57bbb-3308-4274-8aea-5f2b7d37784a", "indicator--98f279cd-8c77-47af-992f-b41e4acbd6b4", "indicator--a65fafe5-5cb7-49c8-8cb9-ceca136859f6", "indicator--8eecbd94-1490-480f-8e55-f27fd91cc73b", "indicator--fbe6ef5d-0365-4904-a155-f7aba7a4461a", "indicator--0b03db77-5eba-43e8-a0ff-f2ced6217fca", "indicator--f4704259-70f5-4ce1-9511-b031d92f72a1", "indicator--a8432cda-11bf-4c27-90e4-e81c89b8c7a7", "indicator--e318641f-9d6f-4f78-ac55-a3a637be8966", "indicator--b4698ead-3cc3-4772-b84b-68d8f14345e0", "indicator--74df525e-0041-4992-be8d-49ac8b918044", "indicator--af211e90-316d-4ea9-9a1e-ed83c1439440", "indicator--866b0c43-1d66-4385-9883-abd806252d34", "indicator--a5c9c46e-e7f7-4775-8ee3-66a70218904d", "indicator--189b2e81-57e3-453d-a989-46f6f2cec31c", "indicator--c9ef7015-505d-47c6-a8dc-3cbdec2667d3", "indicator--96e162df-3ffb-4ce3-9690-24ca6d5b9907", "indicator--3c4e9fb6-fffe-4901-8f57-c890ca46e5d7", "indicator--975f1c10-7b6b-4994-b3a5-f38a07ab1ca4", "indicator--881d74fe-f5cd-42fb-b43a-897bb3bcf742", "indicator--320950ca-171d-4cd0-9cb7-d95d4c598b55", "indicator--f42c22c7-55a5-4447-8445-1a13c78796b3", "indicator--ebf11472-2659-44ba-91f6-7afeb371a1bb", "indicator--00355a12-185a-4761-bcdf-95d482012300", "indicator--1b56132e-2509-4fa5-a652-ea8912ca0970", "indicator--7ca357f5-9589-4aaf-9382-3bf953500d59", "indicator--49710638-9af7-4bc2-b1af-5fe7c3356fbb", "indicator--725c6de1-fce2-4314-8c14-803c23e6f620", "indicator--620be3b8-5a1c-4fc0-9adb-d0c9a2e2c63a", "indicator--85b0ee23-d4e2-49e0-89ba-9a9eb1d82791", "indicator--5dbc5de0-49de-4952-aeb0-fe205efa7f90", "indicator--1dfa3594-6de5-43b4-a278-28eef0928b73", "indicator--eb677430-adc8-4fc1-87e4-20d047302de9", "indicator--2776d06a-0989-44e6-9cb2-b596e32d143d", "indicator--6beca09a-4e48-48fa-9850-0fa2d62b79b3", "indicator--b0481859-4666-4adf-aa0e-743014a760da", "indicator--3b794b39-099e-4760-a409-aacb90bb173f", "indicator--460ce4ba-4ab2-4f7c-8d98-5258d91ac781", "indicator--38cff06a-5eae-4130-b3a9-cee4749b5010", "indicator--15ce5723-500e-485a-a509-f81af7a7196c", "indicator--ee4e25e0-c272-4383-b6bb-aa7da623f467", "indicator--8616158a-38f2-4364-8b5d-30dae6031315", "indicator--0b0f2682-919e-4d4c-8d59-fbdfb6f00d66", "indicator--721c9081-f3b9-4435-a592-c298ac21f11d", "indicator--ec35fcad-ecf1-4aa6-9a3d-dfd5f76e87cc", "indicator--eba47daa-5c3b-48b7-a95e-3630f0357266", "indicator--a01d82ff-0025-45b7-9702-58a2723eced8", "indicator--8a22825e-14f3-44d5-9618-c16544c4f98a", "indicator--d7b9c47f-a2d7-4012-8d8f-ec253f9dcfa9", "indicator--a712eba6-8904-4ff3-b039-ed49e79f93ea", "indicator--b909bf54-fb07-4bcb-a3ad-677c6b56f38d", "indicator--42c534b0-9d75-4991-a95e-9054d02de3ce", "indicator--47c74c18-70a5-4ea6-a13a-f9fba6bee157", "indicator--0d765397-6f5d-4677-8565-da1f08fd00cb", "indicator--fc76d65c-85ab-45c9-aa78-178dfd703d26", "indicator--7d11a715-1192-4d4e-bd9e-89d5c7495de1", "indicator--c125aeef-48b2-40d5-8faf-ec7188506967", "indicator--dbde4d6f-f7f7-45f8-8203-65d8999cd86a", "indicator--e943f889-a8e7-4993-abbb-43de6da2ee21", "indicator--ee860032-52e0-42e4-ba33-fc4f390b387a", "indicator--ce1cc755-a30a-48a9-91d9-1042e42f6582", "indicator--7cb11f51-1318-4dd1-be63-dfe59c0e295e", "indicator--8f10ee98-3aec-476a-841f-d12014bafa68", "indicator--b864d379-50a7-4de0-96ea-95b0326cd1d3", "indicator--defe4280-783e-49f8-8e7f-f9cf5e4c13fd", "indicator--67c58f33-009d-423e-a627-16891dd03f39", "indicator--5a57114a-bd5a-48b6-9342-1908d937fcd9", "indicator--fd86a198-0d39-42d9-bddb-9239a7cc6879", "indicator--7471464e-cdfd-47c9-9a92-6be5852ebf3f", "indicator--ddd49f32-87ae-40c7-95d4-7742e0e66650", "indicator--d8a98d4a-400b-4b08-b382-ac68afde207b", "indicator--d45b0e19-e7d6-4932-a8b7-85ff71e9b164", "indicator--70fd2d6d-e3e1-4078-927e-dae8ee48f9bc", "indicator--a7a267e8-67f4-4e18-bcf4-96f268706b64", "indicator--7c6e2ae6-f56e-4482-9d49-2c436721648c", "indicator--8d3e1c9a-e89b-48c9-8260-57ce73179d5b", "indicator--21a5aa93-b62f-459f-9d29-eb6628695c6c", "indicator--efe03bac-ce67-4faf-8ab2-7a0e49f76b69", "indicator--71ad433f-227a-4b3e-9cdc-79387239ee8b", "indicator--5fdce8c5-b21f-4a22-afee-c3b41241e5d8", "indicator--70d22c84-a848-410d-8f8d-47e4a5ffaa36", "indicator--ea4202de-fb12-4f4c-95b4-7ab6157f96f4", "indicator--52368033-6bfb-4a5f-94c3-732f2a4c7b4a", "indicator--b301fcf2-0098-4301-b5ab-12be40e84036", "indicator--fc2f0e6a-e825-4f49-a9ac-adfea26fb6eb", "indicator--dd4e08f3-e3ae-4ce9-91b2-e7ed43343a43", "indicator--e92ef3ac-3e5c-4988-a6dc-a3ad09a9b991", "indicator--875a32d6-a897-48be-b8dd-b2a7779924f7", "indicator--70c8a5d1-f77a-489c-a556-62c7c19c3f3e", "indicator--1d20e84d-e1cd-4c1e-831d-3dfe46abb478", "indicator--f64dcf44-3c27-4f64-84cb-0cbd06b818c3", "indicator--1ad01185-c76b-4f62-8210-dabef50d6275", "indicator--32276fc1-e8da-437b-8f78-635bf90b0e63", "indicator--c5654acb-3779-4099-8efe-4fa1494591be", "indicator--5e1af656-e405-44de-8543-fc72a11cf511", "indicator--f833f224-618e-4f24-a071-1dce9ecd8fe8", "indicator--27701207-6eda-4fda-baf3-52856d6dea4c", "indicator--2fb8ecd1-9a2f-425b-8e2e-48624c31a4a8", "indicator--74d7dcf6-2369-47b3-a61c-fdfd13b55f96", "indicator--60b2f242-3a19-4067-9756-66b0be4e450a", "indicator--e5b22268-5b7c-422a-b0d4-08e1157f15d5", "indicator--6dbc4717-c741-42fa-b700-ee22566a7f77", "indicator--3e519cec-d233-497d-a42f-390913a3fa77", "indicator--b7934a52-f102-4a5b-80fb-ad26dcb321f7", "indicator--1b5af80e-2f95-424b-a90a-a7844f2f7b07", "indicator--bc5b22c7-a945-4d5e-81af-1e013aa49145", "indicator--b216bdb7-182f-4bbc-8351-51cdf524c830", "indicator--1c36a859-10cc-4dcb-b30a-dd65349596f7", "indicator--b85b2180-1dbb-4858-898f-c314ff7e40dc", "indicator--d868f186-ddcc-412a-ba1f-06556e8c5cfa", "indicator--d7dd9597-d297-4ace-9d97-c9002b16bd4e", "indicator--50f9072d-68f3-4f6d-87dd-2b7aa328355e", "indicator--bdbbaca0-5ae2-442d-8e8f-ce46ff0a7e42", "indicator--acfffd73-a0ae-4c9b-8f66-c710c012de54", "indicator--edd62474-0ae9-4659-8903-3711e7316abb", "indicator--dd29de53-2b44-4015-86b8-edd5629d6a49", "indicator--28cc8f46-5e9e-445b-9d90-de76a2f47865", "indicator--3ada75c9-301e-4202-ab95-eca9ba768e04", "indicator--f451e014-0a56-4b85-b04e-1eccd2eb2c6a", "indicator--c742c40b-b257-496e-b90e-421e8a4952b9", "indicator--4e66b029-d050-458b-a6d2-3e70f5d899d4", "indicator--1b9b12da-30b4-48f4-a5be-93d45555fda6", "indicator--295fcc5c-b65c-4643-a639-e5588afd613e", "indicator--20a406c8-d640-4b48-9ff8-2e8039d54140", "indicator--9b4bb346-6bfa-4927-aece-7f07cba41bd7", "indicator--f4567d02-9205-4c3c-8444-f47fc7785735", "indicator--b39f4da3-a951-4605-81a8-84ea81bd2d6d", "indicator--87c142a2-b2eb-4be6-a457-ed79a5723f52", "indicator--668c2ae8-52d1-4367-961d-16072d43d0c1", "indicator--a0ff5394-3290-4eac-9c6e-beb818c4b4a9", "indicator--cbae4354-a68a-427b-8245-7eee1b7faa7e", "indicator--80e1c7ee-52cb-46c9-af79-e6d03bcc4bc8", "indicator--da0d97af-5696-41bc-b3e3-01494ed683cf", "indicator--7d182735-f2e5-4999-81b0-fdf70098870e", "indicator--df972c00-d76c-4d59-92d0-af94ae06570b", "indicator--e7492515-abfd-4f90-9b5d-69e462922217", "indicator--21013657-4a65-41fd-9cd5-1172b663d238", "indicator--e685c4bb-137c-489d-bdac-413c9562be77", "indicator--f4ed624a-eecd-462f-b735-2ca9c8458ff2", "indicator--fb8f7a05-f881-45c3-a20d-177493e21ca7", "indicator--a909c2a3-455f-40bc-87ec-d99c6422b54b", "indicator--054acc7f-e38f-4eae-a78c-96a7e3336da7", "indicator--240affa5-bc37-4dac-984d-0f233154b9f9", "indicator--c76c7647-f849-4c98-9b5b-697e3ec4548f", "indicator--be35f52f-b8d2-4bca-8dcd-6834e8edb49e", "indicator--f8f4270d-8cdd-46d8-b108-436228266f67", "indicator--9ad66c4d-0a38-457e-8444-09a44b594fcc", "indicator--7e065350-a772-4a7e-9f84-dc34d4a7a548", "indicator--7d56dc2e-6929-40c5-a1fd-7aa6d326551e", "indicator--521835f5-0e6c-4bc5-8958-9a5e8efd3b2b", "indicator--448215ad-7de6-4569-b209-ccb1884aafef", "indicator--2495ea0c-4cf6-4d97-90e4-f480deb13a87", "indicator--37f749f8-6be2-4dd8-87ca-b1b4810a0857", "indicator--22d4757d-90a0-486a-a9d8-8abd58753348", "indicator--98e910d9-80b6-4540-ac4c-d3cbe573812e", "indicator--4b2e2c01-b209-4ba8-abd1-4881740331aa", "indicator--9eebb010-3fdd-4f18-b67d-3564e9755f01", "indicator--f91e9626-8cee-483a-9aae-82062ed79746", "indicator--e56b6135-0eff-4f5e-aa82-53ef511f8076", "indicator--d4997fd4-e132-40c8-aa3c-0fa8140195b7", "indicator--e735c178-51cb-479f-bb49-38d4fedf2e4f", "indicator--d091e1e9-9f3b-4871-a3e8-db7ddf2ff01b", "indicator--e078b0b9-88b9-4655-ab1a-f4f5cfe34b6d", "indicator--0fa51306-efcc-4b14-9ae8-b0e7d8779d73", "indicator--9259a270-e8e7-419f-96c5-360e0994d461", "indicator--ae10c531-dce7-4f8f-833a-81df3d7f8975", "indicator--ff187cc9-eecd-4138-af7e-f01b48c2eab3", "indicator--5b0a69a2-e1b4-4921-b030-236a33a53ce0", "indicator--8b5e2cea-d94c-4a89-bd9b-5dfd6332a152", "indicator--3b8b49b9-0359-4ee6-9ced-338f8e5da35d", "indicator--9e14d260-fac2-4a21-a864-0a714887ea27", "indicator--ddafd289-871e-4ff8-8b02-47d0af3708fd", "indicator--ec4bb80e-7e86-483f-8130-5d111194cd01", "indicator--869ba52b-4c29-4219-b2d2-4e26955ec9eb", "indicator--0c58dba8-4e0a-4f8a-b1f9-a28d90b5b477", "indicator--0238b86f-f3ca-4d0b-8975-d803d7d017c0", "indicator--9b16da12-e7a4-4a7b-9abf-a0cbc69aed51", "indicator--2b102374-06fe-4044-a470-59e6c7bcc2d7", "indicator--4fb92d7c-295f-472e-9061-05a1b7201af6", "indicator--d9ca396a-ca28-43f1-886a-74c774cbdccd", "indicator--078e0e72-2005-4b41-9445-014260bdb6a6", "indicator--3294a8e1-ccd2-410e-9c7f-85cdb229b1d2", "indicator--f81da208-af25-4c4c-bb43-c23d46cd1a6c", "indicator--2411a42c-b807-49ec-a45d-ac82af9fe21e", "indicator--b9cc414f-a23d-4cd3-af19-f74c0532cf82", "indicator--faa03199-89fb-4357-b56f-fa5a07ba3410", "indicator--289276f9-e223-460e-a005-7939109a4ba5", "indicator--0d95800d-c3fa-43c7-b94a-54a3cfbf0b1b", "indicator--f9123af9-1da9-480a-9f96-4e9a5706c481", "indicator--7adbea27-9d76-47af-af9c-cae75dee08c2", "indicator--69b01503-bf5a-4252-96cd-df870cacd658", "indicator--0f670658-3261-4c31-b7c3-c8fe7d901088", "indicator--95116fe0-4cf3-4429-98e5-59d84f525a97", "indicator--f65a3ad9-c083-4a91-a6de-1e58f504e45d", "indicator--c8283857-b5d9-418f-a525-a7cd4e5f8706", "indicator--bf124b74-f902-4ab9-85c1-d673e4452316", "indicator--7055bacf-cbfa-4a9c-9d79-a95b3a7bf5cf", "indicator--f4df1da0-7e00-43c2-9813-3393c821c111", "indicator--5d76b5ff-c91b-4e5f-bb4a-e378b36e5e7c", "indicator--25e586a8-e2f3-46eb-87dc-862ff0dc7956", "indicator--0d20f842-c0d4-46db-9037-4153f8ba2eae", "indicator--54d5e18d-6e53-4231-8580-765ecd61b489", "indicator--241661df-bb5a-4b9f-881f-ead77ed4cbf5", "indicator--fae48e48-c033-40c0-a5bc-0d6257dc81fb", "indicator--28fb0579-d6b6-4092-8ed0-2839d61e85da", "indicator--039f219b-69d2-4886-a928-b1608666e334", "indicator--2474cb60-4c52-4931-9d47-5b8b9965f3c4", "indicator--27aa73e6-8b12-4c43-827c-354da17cc086", "indicator--8c55f53b-d389-4698-91a5-7a008e6dc4da", "indicator--6d4668fd-3eea-4ed0-9593-32dfdf175a4d", "indicator--9f79306d-ca7d-4fc4-88f0-35245d42efa2", "indicator--824c84be-7728-434b-8f60-f1befe7867ef", "indicator--ed1a66b3-bf59-4968-879c-67455e9d373c", "indicator--a62faf0b-2219-4743-9097-1da1cc8c91aa", "indicator--803847b7-b86f-4ec6-95d9-03b7fff45a85", "indicator--1789c4cc-d9fb-4516-b9db-b73dc7969830", "indicator--94985467-3409-4963-a923-7292fb9965fa", "indicator--5ac5766c-48af-4bf6-aafb-6514ef0f1a37", "indicator--bdf39286-655d-47dc-9f92-fdbbe11a050e", "indicator--f2586b1f-6009-4bb7-a067-9ebab1133c07", "indicator--287e8656-f04b-4485-9674-cdbcc19e48b4", "indicator--b0106187-f604-4042-885c-402d7428a4af", "indicator--04d39ea6-ffc3-4fdb-a050-09e936c1a3ef", "indicator--8273ea39-e717-4e1d-abae-97bdb13d5b6a", "indicator--1d3633d4-68de-415f-8cd9-3d2750b00b59", "indicator--11423ab9-4f00-456e-bf0d-f186a1e900c4", "indicator--9c808ebd-ae37-4173-8238-dc2e4c9808f2", "indicator--dbf032dd-5289-460b-b2f7-0014a5157155", "indicator--2833ab03-4607-4bbf-af3f-a2ee77ca3b94", "indicator--1c61b77f-7cd4-4938-9431-e0f67acfa882", "indicator--871a3531-dd9a-4362-b943-083a164787fc", "indicator--6398ca83-c129-47ab-ac33-ac0cc3fedd5e", "indicator--9426c4c0-fc14-4b17-822c-1353284ce9a2", "indicator--6bdcd7bd-0c41-45ad-9666-d86fdc3e79c8", "indicator--05de26f8-4ee0-4ae8-b685-5fdd22d8c6ea", "indicator--54e18994-a0e3-4894-97c7-2ca0b981aea4", "indicator--64609abf-a7ad-4018-a275-16ca2fbed07b", "indicator--19d4f440-bd36-425c-ac5d-ad5654be94e2", "indicator--c460bf88-d4f6-4497-adff-fe03bd48fcf9", "indicator--5c25f18a-13cc-4f3a-b291-c68dbb0be21a", "indicator--7c6d1998-e1fd-4abe-801c-992b149e3176", "indicator--de9b63db-4947-44b5-b3fd-a332d72c2ddb", "indicator--324a84f6-04b2-40f6-a1e8-40da238d2c8a", "indicator--2d46aca1-046b-46e7-a506-0cda2b9cb616", "indicator--89fff459-21b5-42cb-976c-d72883bb1023", "indicator--c1871ec7-f8b8-4ea4-a16f-06fe59a40a8c", "indicator--14349f2e-0cfb-4a5f-bacc-f8c3410a5673", "indicator--73deb00e-a36a-4e8d-b970-cddca306f6f0", "indicator--307e232f-c17d-4dac-a945-e62bd0ece437", "indicator--ff7f91b7-e5ae-4f4a-94aa-0b79391c128c", "indicator--96a8cd5b-57a2-49e3-8042-52fed4e10e6a", "indicator--543e1784-cc5c-41c5-901c-40916e7305c8", "indicator--f6f1ad5f-9fd0-49ba-85b8-2b9549b04402", "indicator--89a4d789-db72-4365-8690-197b64555f2b", "indicator--db86d5e4-52cb-40fb-a424-8423ce72da69", "indicator--f58d2aab-dd81-4a86-b566-d0f88f218732", "indicator--edf637fc-a7d8-4575-a4e0-5cec4516f34a", "indicator--265202cd-5b08-4c9b-a346-95a659658aec", "indicator--9bf52272-92e1-49e4-a741-9e589202b5f1", "indicator--9c0aff77-3108-4f13-9303-1eace499dce5", "indicator--cef9fbc1-aad7-4d73-afcb-1b7cd6dffdac", "indicator--dacb4fc9-6c8b-497f-a131-a8243a4bade8", "indicator--de0864b8-488e-422c-80d1-c147923805a9", "indicator--0834ad5c-1788-47a1-a9f6-e90f3fece96f", "indicator--d03481ff-222a-4f27-a331-8e08fdd424ca", "indicator--eeb7a758-252c-487c-b02f-5906a3df4ede", "indicator--8c4f49fd-790f-4569-b82d-d25b97e62859", "indicator--3f702cec-96ef-4951-93ae-4353ab1c59ab", "indicator--f2aa323a-156c-41a2-9181-5a03c4895e61", "indicator--f4b83890-99e5-4659-afad-603f69ae1fda", "indicator--9f4af87b-e211-4d73-a800-4e7e6f73bed2", "indicator--66e68a22-63b9-4bcb-a0ea-ab735131bbd6", "indicator--1a82e8c5-1a99-4149-93e3-a84cffa51528", "indicator--7a2aa9e5-4338-4a3e-b81c-37434ee737c1", "indicator--ec0b5c9e-128b-4fb2-bbe5-96b21b08c8f0", "indicator--4a348b62-5583-483b-b751-828e0b29a3e5", "indicator--c03a06ce-26a1-490e-afff-0ee0b21c3cbb", "indicator--a090fb1c-21e4-473c-8ae8-72db780cba4c", "indicator--639fe806-fdc4-4952-a7cb-1619ca581f90", "indicator--aceea390-6537-42f0-ba1d-7818d53615aa", "indicator--50725b94-32c5-4035-aec6-06e0a8178835", "indicator--b68d8f90-81ca-4743-8930-c5bfc392dabe", "indicator--d39f6b49-90d5-48ee-be1e-93856455782e", "indicator--66d374b1-5185-4d86-90bd-fb1ea1abe067", "indicator--e4be263a-6d09-4f46-a60d-cad007c481d7", "indicator--c6a864b4-7b08-4e54-83b8-d8da783386d8", "indicator--81eb456c-a3a9-4113-a78b-e1a58c3ce120", "indicator--a66edc77-6584-4749-b37e-00a42f1394e6", "indicator--48b0d8ef-581a-493d-8215-03e0da3da258", "indicator--7b7dcc5f-c06f-408c-abce-286b0c87bb32", "indicator--277f8150-a1b8-4fc6-9eb3-4c0c4b498b81", "indicator--5865e9e8-6747-43cb-9ba4-a036c2807573", "indicator--d99d4bd4-02c0-43d7-afca-3d052d32c66c", "indicator--ee225802-3814-439c-9056-800fa40a225f", "indicator--febd0fe9-ae3c-4048-9fe6-3aeb2b4a8ab5", "indicator--5f4da851-7916-4142-bcf1-df3e02b6ac24", "indicator--74f108f4-50d8-4623-bba2-e87cb50a8260", "indicator--82eddda7-0aed-402f-9037-be6e1e81b006", "indicator--43b26c5b-7eee-4716-a27d-d2a1c02ed8f2", "indicator--d165b3c2-93b8-43bc-b852-52b96c92ff80", "indicator--a5c4cc62-7e1a-4c98-bfe2-a5c30cc024b6", "indicator--58b08bac-ae24-4f85-9ce3-67a0e6f52cdd", "indicator--76e19b2b-02c5-45a7-801f-03a5d75e19d3", "indicator--31e8fe21-3b92-4c19-95ad-32097c7c9389", "indicator--ea74ce68-68bb-4ec3-97c1-7729514c84f8", "indicator--6ce21777-dfc7-4066-8687-db884c4447bc", "indicator--2328c490-257d-46a0-ba46-d390ed953673", "indicator--6b1dd6bc-7678-4a99-a8ae-590f2f0f34a3", "indicator--f61604e8-496b-48f7-b802-e16474db538b", "indicator--48f2348d-cd99-401b-bb30-786ae8b2de9b", "indicator--9724ab38-770c-4daf-af42-68434c208b54", "indicator--b033515a-66c3-40b7-8a33-8e63e44865d0", "indicator--2585fdcf-7298-4729-a583-124c05ad1e01", "indicator--ae8dc945-2520-4a4a-b4fb-c8c041f1cebe", "indicator--4febd915-e637-4f32-9b2a-088996cad68f", "indicator--da87ca90-d3be-4348-852c-b3063b0b314a", "indicator--9b98d577-8a82-42cf-a212-43c722b4c540", "indicator--d3512968-d04e-47e1-b356-26e829f4db93", "indicator--c6b00d74-48cd-482f-aa0f-ee978f57079b", "indicator--e4413839-4376-4355-aaa2-734cabf3a996", "indicator--631cb7e3-de1a-4965-9dce-6b7e882263fd", "indicator--e8dc5411-7ec1-4bb7-9f80-1ebf4c58ea36", "indicator--04d97fa1-1a15-4fc6-ac2f-31008cdcaa4c", "indicator--b4c14c82-a144-488e-bb07-a80d497b527a", "indicator--46a629d2-3d93-4ac3-97a4-f342d01ff685", "indicator--8e9292ab-ffee-4dc9-8959-70cc78676387", "indicator--45c27f18-d163-4ca7-9a31-9fe03c383137", "indicator--ee3eda72-096e-446d-b9be-a976143b562f", "indicator--37577b5d-c328-463f-bc6d-83777ec53d90", "indicator--8dd296c8-b55a-46b4-848e-83f781aa3aa2", "indicator--f375f572-046c-4f7d-bc15-0308baac216e", "indicator--f82e0cf9-24cd-435e-ac0b-f7e1bc123846", "indicator--c5f1e861-9686-49f0-9c13-f48a93626816", "indicator--ab584ff5-d84c-4b6b-847a-177edbe02b3b", "indicator--18469cfd-6a88-4cca-b7bf-f161f1d31aa0", "indicator--54f35833-cab2-4b2c-bda4-2b940f7c1649", "indicator--729e9dde-650a-4faa-906e-9a7d5d7d49da", "indicator--edb57862-2e47-4dea-8f55-1628b5e749f8", "indicator--168180e8-69a0-41f9-a061-8896b0b29aa0", "indicator--391c83c6-6046-4aea-8b66-7d22403a388a", "indicator--23ba72ff-5508-4dd1-b563-ae58dfb807d2", "indicator--a6f5e271-4348-4a6c-8215-4f0c369f9dce", "indicator--49d8a277-bd5a-4135-bd30-2d4b4156ff87", "indicator--c3c6a203-133c-4f67-84e6-0234a13e0207", "relationship--316cb3a3-8044-4585-9699-44a29b8bc736", "indicator--fb069513-585d-4ff7-8340-aa73dc101e6e", "indicator--49fe391c-aee3-4d97-a52c-7b3aead739cd", "indicator--325a3a2a-e8cf-400c-965d-a156b5322320", "indicator--1fa3c7a8-12ff-4e8f-9d63-09e8df06ee4a", "indicator--aebe53de-7cc0-46c6-86b6-e2bcfb6ac2aa", "indicator--e2c9754b-1619-4320-94e4-14504e185d4e", "indicator--5ea76da4-e26a-4a6d-8156-d3012c4614df", "indicator--d1ff6253-a9c7-4591-9254-a803c2b0b969", "indicator--f626c2b6-8928-425c-9d1f-417cea395dd1", "indicator--e6085296-fb86-4c89-83ee-08145f2bd1ac", "indicator--b2b5932f-2c7b-4e86-9d5c-4f8853dce952", "indicator--8cfea9ba-b14a-48b0-adab-71fb6fc0240d", "indicator--64638990-643f-460b-adda-1a38fec2e2f3", "indicator--19915439-c154-47f6-9940-42e91dba8c9b", "indicator--8fead2ec-c3b6-4695-9f76-300533b01d7a", "indicator--997fa5cc-b219-4c6e-9a5c-ff32749daa7a", "indicator--41b44673-24ae-4ac7-a599-d1e151a902b1", "indicator--52aa5887-13e6-4166-b152-dd9e86bcdc8e", "indicator--3fc15adc-26a3-493e-8d45-06525b7c19fb", "indicator--15dcd9ac-d12b-45e9-a3d6-e0a5fef916ed", "indicator--e69d8574-78c7-4107-bca6-b6e76af25704", "indicator--d553d067-06f5-4013-8cba-fa8608185f2a", "indicator--a905883f-2d84-4fcc-bbb1-185fc13847fe", "indicator--f87c8050-ffd4-498c-b559-33ca2322dd8e", "indicator--b8be019b-ca2d-471e-ab85-17129926f17d", "indicator--46e14065-a2a7-4189-bfa1-3426a3f1fb54", "indicator--4e86d6db-cbe3-4c60-8162-6f7bcd38ee7e", "indicator--4e8d638c-df11-47b6-a82f-3a6bac1cd695", "indicator--2f5ed9e8-9e75-49f8-8df9-278065b2e667", "indicator--2f10801b-e5b9-4d42-af2e-5a63020b7b31", "indicator--c5d1c877-c55a-486c-a1c6-f8621d6b6bcf", "indicator--76ce43a2-427d-41c7-81cc-4b3ef6067f92", "indicator--ef81f9cb-845d-4b6d-8474-306b2ba7dbb1", "indicator--0e5c21bf-01a7-4c63-af2e-5931bae9ad4f", "indicator--3764b167-dab9-4235-97b1-9c5ce9a5fcaf", "indicator--db43f8c5-23ba-4c7f-abb2-38251db25e2c", "indicator--7d4a1892-c9b2-45a0-ac6a-909b6a3ce20d", "indicator--67aefce7-9c5d-416e-aa6b-9c3e7d832a3c", "indicator--503b329a-7359-4356-9117-044630530630", "indicator--e60918fc-9e47-4956-8cfe-fe5c19a5f001", "indicator--cbacee14-281c-45e8-ae9a-7d5d4fed7642", "indicator--28027e83-47fa-4eee-a823-20a8b2ca8629", "indicator--05777072-4670-4471-8423-899aa9399e50", "indicator--98ae59c4-834a-4194-95d5-14fe731554c1", "indicator--c5e944f8-182a-4360-8aa0-60e78d711265", "indicator--85b296cc-b1b3-45a7-b787-bb0710d18de4", "indicator--7a0a2319-de3d-4552-b7e9-0dcbe71b3272", "indicator--596638d1-a2f6-4d7a-8ec1-267f59640c6b", "indicator--c364aaea-bd78-4fd0-b07f-dd1baec3af61", "indicator--fbb0bd05-9b4e-43bd-b7a9-d5e78b50887f", "indicator--b15d20a7-ae71-4e1e-ac0e-470e5cf20a28", "indicator--f26e2e54-6698-45aa-973f-a7debfabce2a", "indicator--c66cc51e-8eb6-444b-9a77-675182d5c543", "indicator--a5dba0ba-7e25-4f34-ae46-124b6d6ddf55", "indicator--b32c3ca4-f149-44a8-a119-a9189a612d25", "indicator--f4d080f2-df11-4c07-904a-7b16c98525c4", "indicator--31e33222-627e-4bb6-87b7-e15796e09b6c", "indicator--cd3e4ed3-5128-43d7-937f-097b6f6bc1d2", "indicator--c01fdb58-6ca2-4c57-a5bb-157e05f37d13", "indicator--0edb2a26-e3a7-4877-9ab9-990ae71bf459", "indicator--a23cd016-803a-4d4c-83ed-21a5fea90398", "indicator--83ffc4ae-3aeb-4b87-96e0-f321eed463cc", "indicator--1ba53e30-9203-4738-ae1b-d6e752df8141", "indicator--dd4ade97-595d-4f11-8d83-ecb532f0051c", "indicator--6814685a-8978-41c9-a32f-68e6f8b22269", "indicator--d284c0bd-8570-4f55-a4e5-908e20e43ddc", "indicator--18b79bd5-ec5f-42dd-bb25-9fed097127e4", "indicator--7a28df4b-9b51-462b-bf3c-5cb2b86455ca", "indicator--80e274ee-b602-495f-ac38-a188f8539870", "indicator--bb526c04-dfa1-4234-b6dd-80773326f267", "indicator--4a69be44-e1aa-4c15-92f9-18b4768070ff", "indicator--2972d71c-7482-4d0f-b9d6-4e8ba0f18520", "indicator--8a294523-8162-4a03-bedb-e1132af4cad7", "indicator--3cc196b8-92f2-4384-957d-9a5e0149f6c5", "indicator--1e96569d-e34e-4013-b569-bf0a2c3cf241", "indicator--2b6e3884-8cb8-4fc3-a8b0-d48f6c7b458e", "indicator--02576a38-d142-498c-ba5d-b051d5a264cb", "indicator--7d440032-34ea-4122-a2b3-9539c79849e1", "indicator--8c30936c-aee2-4ea4-bd39-843c7ee6a430", "indicator--b7adfa89-e71b-4e9f-913a-4fd8ed75e714", "indicator--23109063-19d2-4226-83b4-edba71933b65", "indicator--685ee17e-638a-4d45-afd7-f748361b1b9b", "indicator--c3976005-79d0-497b-b2f1-aed7d1cbf7e4", "indicator--540bc0db-d268-4432-a8a6-8e94af3a7201", "indicator--6d02a526-a74b-40b3-bab3-4bd1e92e9c46", "indicator--11ad900a-ea83-4782-88a1-666c671f0c79", "indicator--aa6be721-c7b0-4f82-a2a5-21459653d7aa", "indicator--d6058f86-1b85-4596-9514-77964ec2293d", "indicator--c3f2d0c2-f372-4530-a0f7-232e03b20004", "indicator--2ac53495-d3b4-4376-af00-804380eb5b08", "indicator--27951cc6-b90a-41e7-a728-2a11c1921232", "indicator--23ce6881-455e-4d59-b9d0-78ed56af029c", "indicator--b1440cba-6a6d-4b76-852b-f84ff5ffcfeb", "indicator--1a65e73c-ed14-475d-ae4c-bfbaf54e9c48", "indicator--c3d9db1d-9dcd-4b95-b12f-f7b860600a3b", "indicator--2f93820a-5c3e-4122-9934-9e4e39292c5e", "indicator--cf1407ce-5b1a-4f8c-9d6d-95a4d3ab1432", "indicator--a3494d34-ef62-4ff7-9382-e367c796c6e9", "indicator--f96d3438-ff37-4120-a3d9-97b07dd1a72d", "indicator--b644d620-4765-4630-beb0-aa6fe7e74351", "indicator--ec99a037-d2f5-456b-80a5-95989e4b5676", "indicator--f8be9915-632b-4bae-a64e-00010d9cb882", "indicator--46d56ac0-d26e-42a0-bed1-8559874e56b7", "indicator--4d68e3d7-5a06-46db-9c09-d769c7e350e0", "indicator--76c81fff-aa43-45dd-a26c-4d6dc79d3823", "indicator--2c0467f5-fd2e-4b88-bdf0-a5a72d3d509e", "indicator--603fa7bb-4dc6-4865-971f-29a544f27d0d", "indicator--1657230a-b096-41ec-a936-11672be05f0a", "indicator--a9d9dfb9-9262-4615-8836-893e0d323075", "indicator--785d06be-80ea-4800-a635-0e085a614a14", "indicator--397e4df8-7b5a-49f3-bda8-06750a536787", "indicator--08095e47-afa8-4d07-b14a-770bee161e1e", "indicator--a7c4bde9-b001-4147-b2b2-090d9d7c3de2", "indicator--9d28a3c6-fd8b-4399-8e54-4d72a630a345", "indicator--30e1cc29-93f2-4e3c-9891-1378a958ecb0", "indicator--ebf69aa7-dc7a-4d2b-bd95-d5f976d57fef", "indicator--da80bdd9-48a6-4710-ab19-df09866b9f20", "indicator--4362d435-a1ad-4494-9c1e-cadfa3c0d330", "indicator--4d4e601a-0d1e-4c18-bbe5-83f24f87f057", "indicator--720128e4-8401-448b-a62b-5049b98c3e72", "indicator--79f37619-8f9b-4f78-b249-eee459d54538", "indicator--21ae3b71-4798-449e-8a91-ba3c3f32a240", "indicator--866f23b8-9feb-4b63-9108-1693d32453c7", "indicator--6975c56d-1744-4605-afb9-aa2a66df90ff", "indicator--2c491696-dd88-4809-88b0-0f90b9629509", "indicator--e2c4c7af-348c-4a84-9475-4dcf2dd82161", "indicator--905af4a0-b4da-436f-b1a7-d6d3ace1166c", "indicator--f116bd36-8036-4c84-994e-fc35213c75de", "indicator--bce56314-ea67-4530-8f0d-ce5f612eaa18", "indicator--fe64177b-3448-4b44-81a5-d706862b2872", "indicator--d698e2ac-ffe5-4753-aa82-a5c390caff45", "indicator--bf1d95a0-5845-4491-b679-f1e7e8d3d4fd", "indicator--8f1f91d6-acea-42b8-94d9-b8c2e47583ed", "indicator--f9bf59b6-4863-40bf-9183-deff9586c141", "indicator--7ed01d3a-ea3b-431e-a1d0-57c729f4f5b2", "indicator--3be8caac-42bb-463b-a31b-7a43c23b52d3", "indicator--33a23dee-2f43-4a11-87cd-60a21af6eb1d", "indicator--666e6eee-f5ca-4804-9e22-06eb2216bda6", "indicator--a5bda2c8-e20c-4378-8a38-ce079164065a", "indicator--22713847-afad-49f7-9935-8b70d999598f", "indicator--4e1afd06-89ed-4887-ac38-c477916fbfc2", "indicator--8ae8200a-07b3-4097-98ec-7e8433176b5a", "indicator--79e31163-a426-44cf-8c2d-0e30ffe2f348", "indicator--ece1bd0b-4fd5-4d39-a845-b66ea7b68bb8", "indicator--88a33604-25b8-4622-8d9e-d41736236dc4", "indicator--b7931382-1b45-49c1-ab4d-dd7c419b0d57", "indicator--12757617-d683-47e7-8ef1-2e21a418195d", "indicator--71459f02-a6ff-4963-afae-1a368f1b4d51", "indicator--f35f551e-2d21-41f1-86c5-a5f6d4b7f4a9", "indicator--4fc78434-77c0-43f2-886f-54ccaa84b5d2", "indicator--d3756e37-68a6-4ed3-bb2d-1347a1d3c982", "indicator--bc8e97d7-45c5-42be-b34e-18e9f8da33ae", "indicator--7082fa86-7519-4aa4-b497-ed044b288816", "indicator--c42b7904-0196-4c47-a2a9-4bc09745b1cf", "indicator--a27d014d-8990-4994-8006-b0d3cc622979", "indicator--473f662e-6374-4db4-80c4-cfe7a6971c90", "indicator--0db8f687-875a-4e65-8d81-2956071423e1", "indicator--4e91550c-490b-4691-8ab2-e63fac80849c", "indicator--2a87138a-aee1-4344-8601-8e393f6785fa", "indicator--74706b85-100d-463c-802b-971dc925361d", "indicator--de66576e-288e-4a75-bc10-98bd678386e3", "indicator--38689fe9-de59-4b42-b4c6-05060d3eaa07", "indicator--10d6bd6b-39fe-4f18-88d0-5d18e5456d4b", "indicator--f16fa3bb-a87d-4e0e-bf9f-712babb3d865", "indicator--bb55339a-74bd-48e2-a1e5-27486a6228e5", "indicator--2068d787-b62e-4ea5-86cf-75bc2e7aefcb", "indicator--7a0680fa-d90b-4db4-9935-62569b5285b6", "indicator--402cd15b-1c3c-4bfb-90bd-faf98454ef85", "indicator--bd2f1191-1c6a-4f54-93fd-e2b99452279d", "indicator--5980da60-0ab2-4cbf-8ba9-69e3af65589f", "indicator--a451d683-2480-4cad-8d13-00b48a1a8193", "indicator--a284d34d-bb81-4dfc-ad28-6b5000f48072", "indicator--b12c61e3-b3b9-40bc-a08f-bc076ace4428", "indicator--5a7bd6e7-004d-4f3f-8eef-f6a9f73cfe5f", "indicator--76c7da8c-5b7d-4f4e-9942-b18889c6af18", "indicator--020de442-1c86-4a3e-8440-b73e69f5b0ca", "indicator--1813322c-ab9b-4d04-9b79-f3e78493a6e6", "indicator--58675c7e-4270-4bc1-8651-6e6024745a4e", "indicator--1acf9cb4-b726-45fa-b876-affe62d1e7ac", "indicator--fa77d01e-4210-4e61-9ef1-6389b8aa73f8", "indicator--95c8238b-e33c-4485-ab0d-0bad2fcc1fbe", "indicator--7ab5753d-af1e-49bb-a88e-7700a84c4190", "indicator--500e7c8f-3db9-4ceb-8c90-ce726a58cd31", "indicator--78e8f0e6-b724-4551-8fa0-f869d6ed5a4c", "indicator--337b300e-703c-47e2-b481-6a3bfa70800e", "indicator--13bd55e8-dd1c-486e-99ba-fd3a028f7f46", "indicator--02c4a6c8-ca41-4a1c-b148-3571a4957538", "indicator--dce50abd-4139-4d05-8f58-bb7c8755b100", "indicator--aef3d773-819d-462d-93eb-80d5229b9ad7", "indicator--689a7f27-3cee-44c0-92bb-efbf0b9c0e41", "indicator--30ada8a5-2839-400b-9b95-11eb2ae915a2", "indicator--303c5480-2461-4a10-ad30-66bffe2e325a", "indicator--5cf3761f-3183-4e01-96b3-9fb44c4ab9f7", "indicator--cddcc486-d8c8-4c49-887e-235f478e1813", "indicator--edd19ff3-0d87-4512-a876-d6e7dce4494f", "indicator--f0df19e3-8315-4d1d-96b2-cb2a0d60966e", "indicator--b6d31b17-42f7-4c45-a485-3ddefa022482", "indicator--76e43c1e-0492-4cd4-95c3-b9ab51067aa3", "indicator--3f193861-34d7-4576-8672-77af109ee6ce", "indicator--cf2d95fc-fbca-470a-a9a5-a7e03a27d28b", "indicator--99e88e97-9c29-4614-b722-07b30a968aa1", "indicator--973b4dec-25f1-4868-9f83-6ca78801a5cb", "indicator--7dcec7ec-2624-451b-964e-7d934eb3be66", "indicator--7714de76-438a-4e39-9f63-6918e62da333", "indicator--f57f68b4-6ef3-4db4-8f03-4502994820f6", "indicator--f71c1e62-d6aa-486d-86dc-8fb82c7c0f0b", "indicator--ac13a45e-e40f-4a2a-8815-441ff194104d", "indicator--7757f9ee-cebc-439e-b910-f9368acea53d", "indicator--c9ce646f-68ad-4650-864d-1c9070d035ac", "indicator--cdd823b0-1c9b-48ec-b803-179e77db8565", "indicator--59f719dc-3e15-4a78-81b2-6713739e7caa", "indicator--bb59f01e-8ca3-4559-b761-255fe087a63d", "indicator--c6f0c611-e5d8-4ef3-b143-15bc522ab264", "indicator--9de62f2f-dd47-4ed4-866d-dcbeaf3dfe97", "indicator--a920a6a5-b031-4f11-8ebd-752aff05a678", "indicator--1d159b07-9133-47cf-831e-fb7ad2e10f15", "indicator--86c86233-1d27-47ad-aade-c5b393930b4a", "indicator--e7b94e45-0588-4989-9e06-705a2f9034f4", "indicator--7e17bf82-278e-495f-bf4a-85ad8a71f708", "indicator--716cd433-71fb-4984-9d4f-59a2d7e8e48c", "indicator--2dd1c92f-b4e1-4124-b58d-fa835bb6a95e", "indicator--4e59bb53-94f1-463b-adb6-06e406b7bce2", "indicator--fdc8cf4a-4df5-47b5-b1d7-dad7affad6ac", "indicator--5fdf7661-aecc-4e75-8196-d730b633cfb9", "indicator--ac40b12c-e11b-4c6a-8b94-cb50da0dee26", "indicator--17e9cea9-74b5-473d-bc69-bc44960e1b1d", "indicator--5b872785-032b-4b2f-81f0-569d861e103f", "indicator--10bca74b-d9c9-45be-a08d-8aaf1e6130c7", "indicator--8e072c74-2229-43eb-a277-ab5744a63386", "indicator--51e27daa-6e2f-4dee-a815-7c84aa214010", "indicator--58c2f2e8-3b0a-49b3-a6a2-c4dba3245e16", "indicator--40e30f6f-573f-4f6b-8fee-8627b7982973", "indicator--19e1ca2c-e5d9-4caf-ba29-11e85549c13c", "indicator--fb73fa1c-e67e-4927-bd5f-5e71d6947ceb", "indicator--853dffbe-6851-41e9-9aa5-36fd157d0fee", "indicator--28c876f1-a251-4a63-a9ce-e60d15817ca8", "indicator--a04e4cf7-39c0-43b9-8ecb-c534dc241b24", "indicator--8efeb5d4-bba4-49ff-8bc0-79a424e7c569", "indicator--0831a76a-797f-4944-abed-daa400400d6d", "indicator--4d55c56e-34da-4021-b067-5edc7df3967b", "indicator--56a04648-3dc1-461a-a7dd-ff8785179d89", "indicator--50cc0261-3d93-4494-bff7-4d59cddc6bd7", "indicator--79219928-dbb9-4d30-a307-722e95345091", "indicator--703e2f48-3824-413a-b5bb-e5a35671c132", "indicator--5aac7353-2b33-4e6b-bccf-57a4e1910a01", "indicator--05510af5-0a99-402c-b6b2-45c7fc42ea15", "indicator--73b279ec-db1a-49d0-a009-2bb700f16ffc", "indicator--89827c2b-da47-4f4b-b226-a362e255fb65", "indicator--107802a1-dae6-426f-bafe-e9b17e250de5", "indicator--0b15efcf-fba4-403d-aa67-39affc92ccc8", "indicator--45081979-c7f5-4393-97d1-2432e9caec3f", "indicator--cc5f82e2-14e8-49ca-8989-d39218405ad6", "indicator--a4e83c7d-ceb9-4b02-8eac-046f78101f81", "indicator--a25168ef-5dcd-4ce2-b7a8-0111c9d63d08", "indicator--ebf12ae7-1d94-488d-a692-e5d2b62f1611", "indicator--94938028-af14-4625-9e37-95729ad1a1ea", "indicator--a573e65a-2566-4e72-baf9-cb4b3759f013", "indicator--8b31e226-3d84-4e4a-bdc6-797ce008b247", "indicator--90a74f19-96ed-45c8-aa92-f70cecd3ded6", "indicator--7509be5f-e818-4065-9fe6-b381bf8586ee", "indicator--91b7dd1c-8f71-4651-bca9-d141f787dd51", "indicator--4ab00000-5296-4efe-ae99-19cfaf626943", "indicator--55b70329-61fb-4f2b-abdd-3cc1be4d2547", "indicator--e07e9a28-54a6-46e9-b9dd-bdb6ddc783f4", "indicator--941ba36b-42be-4c11-b9a6-d2900031b149", "indicator--48fdced4-4485-4f47-bb6a-2cb7aa61035a", "indicator--6e3c4e9e-27c0-4810-b740-fba81e4ade54", "indicator--0d391f36-0ffa-482e-88db-1c0986678284", "indicator--da8a9cae-4d14-4fff-9fc8-e097f474626c", "indicator--9e488efa-36b3-48cf-94cb-36a41223cd4d", "indicator--168165c7-e716-409a-b008-a35e9372717b", "indicator--93c9037e-fe15-4606-8314-9e4bc9ebc5a5", "indicator--e38b5d7d-c5a8-4028-947c-5416fca980d5", "indicator--873107aa-719c-4605-8405-4f979f08c2df", "indicator--7fd0a8e0-6b1a-4072-80a5-f5fddbf4af54", "indicator--be15b0d2-8f69-41a6-a69a-aa7acf7417a9", "indicator--ab8f2132-b1df-4e5c-83a8-c98f5ce37b2a", "indicator--c03010bd-1d4f-4bb4-a4f8-1b8345788c51", "indicator--03ede66d-d152-4dec-9da3-e74ca572f807", "indicator--93363fb5-0ed5-424a-ae05-278add4c055c", "indicator--d33a86d8-12d9-482c-bcde-adff0c8b6cd3", "indicator--0151b8f1-997e-4242-946a-95052493aeec", "indicator--485e81f4-261e-4cbd-9e9b-7202e7610fcf", "indicator--6322f361-865a-4e63-8e07-7947bee3aecf", "indicator--d251d224-a0fd-4a8f-866d-2fb7ffc59865", "indicator--41bb9c7b-fd70-4edb-b670-133a552a2452", "indicator--dcf03510-16d7-4278-91ab-db8d90e854f3", "indicator--2a9f055a-51a4-4ade-af9a-3677b59b4c19", "indicator--7511dcd0-a245-43de-a934-848513443f37", "indicator--c4e01074-97e2-4408-bc3b-3c670b35c8f3", "indicator--ce7fab1e-3dce-45a7-8b44-99c88e55f284", "indicator--5534af2b-82ee-48eb-8e4e-4a67842423bd", "indicator--aeb45836-1251-465e-812d-91680f9ac502", "indicator--137d3483-895b-4b26-9dba-c1e185166595", "indicator--4c09f7c9-98a3-4865-a40e-6662d8d8857c", "indicator--de8eca1a-036b-4dbb-a6fe-e017f68396fd", "indicator--a8fc101e-3eaa-45af-8aab-2991b9d35e73", "indicator--7f5fbad9-6145-4926-bccb-da13a08d6763", "indicator--4c94b8a8-8fa2-43bb-b011-dce295f939ad", "indicator--8c00b3e0-2eb9-46b5-a59a-b2b47111e457", "indicator--673025b2-cc8b-4eb3-b0ce-e0d97bcf3166", "indicator--ae189a66-ec41-4ab8-9ffb-c9c79b5093f1", "indicator--57da38b2-4a6d-4f95-8922-8fcae027adee", "indicator--23c0d3ac-4560-4a72-a72a-e350834f8c5d", "indicator--aa3368ff-4b14-4bc6-9fb5-51131cba811c", "indicator--0de30a71-357b-4ffc-98c7-84a150e2fe9c", "indicator--8932ac3e-77c6-4f2a-9a45-afdac5bfd239", "indicator--e5f9324f-e47b-44a0-810c-2715cd1696e7", "indicator--31d2d5d2-dfa6-4bbb-9c64-ad752c89fb7e", "indicator--bacf0fdf-1d56-4085-9234-047ba650d388", "indicator--e6792ff3-e68e-413c-90ca-6f561bfed6ba", "indicator--d905a6e4-fb0e-491c-a525-e2fb98b9e7d8", "indicator--dc5b3448-0a5c-4818-aa12-9128bf2a77a9", "indicator--d2e33a7c-31f4-48af-85fa-204609140895", "indicator--4db916da-b36e-4f37-ae14-d8b446b120be", "indicator--168eaf06-391f-4194-9f01-9d3cff6fb5d6", "indicator--34e83b9e-83f2-434c-b24c-6e82ccaa47a9", "indicator--96b1718a-22ab-4939-a3a7-698d075cefdf", "indicator--719e0647-2f67-4ae0-a73a-6ad49df77216", "indicator--ec96a072-3e6c-4c90-b09a-0210e1357552", "indicator--cdf36277-0217-42ed-8db3-52d1f6498c10", "indicator--d0b69f86-cde9-4efb-af28-b4dda7474128", "indicator--4aa356a8-e408-4329-96e5-d647f58b7115", "indicator--4632dc06-e1c7-4f61-abf6-4c6f975f33e8", "indicator--060fc67f-5095-4aa2-88d7-af89c368e313", "indicator--93dd9e0e-0642-4488-a42d-b95b171a8f64", "indicator--a19b0b84-639a-49be-8932-7fbac5aa550e", "indicator--4eb48c83-4c43-4119-ae33-76bd10281199", "indicator--5a3c2c54-6e7f-4238-9047-5f079a246fa4", "indicator--33868f9a-9396-4ce0-87a6-8008c190cdca", "indicator--4c3813d2-a5ae-4e56-8f92-108d10558745", "indicator--95cccb17-c06d-497d-867e-53872875dbd7", "indicator--df6f3f6d-bf43-4a49-9aea-e5fb5d72774c", "indicator--8f6771a9-7358-4638-b53a-03cb365c72f9", "indicator--c88f642b-5d64-429f-a4cc-ee0a92c9f2a8", "indicator--09609114-b1c6-488c-9cf2-98b800ad0ac3", "indicator--64775ee4-7169-4639-a870-239aa93b467d", "indicator--81efcd26-e819-4f35-b22a-df1789d0a975", "indicator--d2774c64-2f96-432e-b961-14a90896a86a", "indicator--d2c29f5d-ff1e-43c4-97ad-c377f4c430b5", "indicator--f789605d-269d-4c4d-b6f8-7ba82aa88420", "indicator--d53f3130-a2ed-4377-92ce-94ba208ea678", "indicator--74517879-5f02-4f06-9e56-5584a8775b28", "indicator--8a798edc-11be-4a51-a1e9-63c4ffd4f251", "indicator--de27111e-1f73-4034-ab9f-a22558af7647", "indicator--f1309423-a3af-4dcb-9022-dc9627c3d999", "indicator--0ee18af4-9493-4de0-ac0b-3c9752660199", "indicator--c5293a9e-8590-4929-a80e-3ba56cd320ab", "indicator--63f25ceb-6b52-4902-a0e8-77faeb31e6c3", "indicator--714d30d1-8aa9-4215-98dc-3afd6d5ac149", "indicator--362cdcab-376e-476d-9b19-a8aa25c7e877", "indicator--941f91fd-bc2a-4b81-bd72-2a57271bdb13", "indicator--af7da80a-4ab0-42bc-a4bf-11555e42a70d", "indicator--11596ae1-803b-4a99-b694-477afe189a04", "indicator--e23c5011-1cc4-48ad-b817-91749b38dcf4", "indicator--3866d406-b92c-4468-b15a-232bb1a3a627", "indicator--4df37f5d-7ca3-4110-8252-139bf8215352", "indicator--5ef98a6c-4910-47a1-a4fa-523aa0c23133", "indicator--c59a15aa-8e76-4253-81c4-e922aef3a018", "indicator--98bedd1f-8465-4339-85cd-ad4d94e81ef2", "indicator--4ff926ba-6726-4145-8aef-10710c0748da", "indicator--cb5314bb-4484-4714-9ed2-8143334dde06", "indicator--1e0a3ab1-26c5-4324-bca5-d918369fce39", "indicator--c70a38e9-5590-4c02-8972-4acbc1005e9c", "indicator--4fa27742-564e-4d03-aa59-80be671ace44", "indicator--c05932c0-7b38-47e5-b8c7-9cb92b3dad04", "indicator--437cf1de-0dc0-4c06-82e5-338f8250515a", "indicator--2af50c34-db01-49ae-946e-0d5b8e5caf96", "indicator--324d4767-dee7-484c-a7fd-ca0daf351a43", "indicator--71b59c2c-3050-4e69-aeaf-a2ccd0c16196", "indicator--240589d5-fb28-4993-9574-3d51eb0bce64", "indicator--984244da-2a24-4afe-af11-539fa00a92f6", "indicator--6dd48a5b-39ed-432c-835e-98c0f13e71e6", "indicator--af829fa2-2dd7-4cf4-aec6-1951437bc593", "indicator--c3bcb5ff-66c1-4b91-ae4b-c96040612b81", "indicator--e9d664ed-78c3-44f3-ac24-1692fb3f24aa", "indicator--bd7a2dfb-a1a9-4a17-9a1d-7ae0b726986d", "indicator--a224c280-6a92-4103-87d4-bbf612fcfc3c", "indicator--41ffde3f-ee00-494e-a724-89c874701d55", "indicator--768c9eb4-cc79-43eb-8237-a40646d55ff5", "indicator--8559f7a9-b82b-4fef-8ba5-aa2956fb70a2", "indicator--ff0e5887-cb8c-4c81-9a58-6993c0fda54e", "indicator--c6d4af34-c30f-41c8-871c-e0f090f3bd08", "indicator--ebfac1f7-48f1-4dd4-8e4c-4254c933ba6e", "indicator--6b24223c-aa6d-4d00-bfd3-408f6ce616f9", "indicator--02940cdb-3153-46eb-a008-8fe11a34d9d8", "indicator--4501f711-ae64-49ec-8e73-960665d1b831", "indicator--42e22494-77ed-4fc4-934d-4599e42cf7b4", "indicator--7b7142a1-7b41-40a7-8a1e-ed342bb227e8", "indicator--6673d396-7b26-4f1a-b223-e3710a6a9cf7", "indicator--6fcc400a-c786-49cb-b4f0-5e88d6ac6afb", "indicator--d4b7a084-937a-4fc7-a3b7-d8d849333cf0", "indicator--bf4da0ab-1ea6-487a-9f5b-de9fcb39014e", "indicator--a47192d8-0bbf-4a3b-a940-1be79d155d96", "indicator--a79c3c31-fe8e-47b6-9614-436a6beef6f6", "indicator--cdb69c70-ab23-47d2-ab76-caeba7cc63f0", "indicator--5eef9714-7dea-4097-9c4b-6bd218a15e92", "indicator--686974ea-9d70-4bce-ba6f-59a0fefc10bf", "indicator--25242761-7df8-4d4c-8460-82734aef6079", "indicator--58696bb8-bc90-47bd-bfe1-4fda0bf403b2", "indicator--6ffdcd58-e8cb-40ce-b4ac-f2ba6e869c97", "indicator--1084552a-0bd7-40d3-8198-a36136d503d7", "indicator--6cf7753f-090d-4152-b471-a212734d59ff", "indicator--fda10eba-86af-44cc-9ddb-210c02f85481", "indicator--c4ddeeb6-8d7c-41d6-bb4d-b9b5151a4978", "indicator--b89a3725-1580-4ace-aa00-857311258b3b", "indicator--23496427-ba7a-4341-a0cf-109071279e27", "indicator--0300c8e2-2ab4-4e62-af31-bae819580686", "indicator--eb9272fe-5741-4ad1-9bc2-d630e7fd2159", "indicator--f4383d8e-6ebc-4432-af22-8179585e9e52", "indicator--3aef389c-ad45-403f-ac34-982307876400", "indicator--2d763ea6-98e9-4657-8211-bd000e7dd69e", "indicator--127c0989-58c2-401f-8c45-42ac0165ee40", "indicator--697982b6-bcb0-42c2-8dc4-395183633a6f", "indicator--d0a11585-df32-4e44-b0bd-9db9afcef15e", "indicator--0c7f5c8d-a412-43f0-9507-6e3a478f8825", "indicator--b68f57f4-6d88-4ada-8934-b262f0a8b337", "indicator--6ab097db-5fec-4f9b-9b30-6d9e72e2c383", "indicator--17a41b3d-e97a-40ef-834c-f992f377cb43", "indicator--e9de77d6-80ac-4676-a728-b968da69d377", "indicator--3d41092b-f6ba-40d5-887f-8263583b547d", "indicator--0ddc179e-1b55-429b-8b10-088b7e960afa", "indicator--fb1d3cf3-ce43-4422-a33f-f736d9c204b1", "indicator--b9104e90-b221-4909-b978-61e9482df799", "indicator--ae8a23ce-68fb-406a-a1fa-7ac1d44530c4", "indicator--96666bd6-67d8-453f-adc7-807492d747c6", "indicator--6fce3de3-a347-4f02-9980-3a6d7a549a3d", "indicator--0ea420fc-e623-413c-8d49-7a84b7cdc446", "indicator--e17422f5-7850-4046-a0d0-e11f7cd660ed", "indicator--423d183a-6be2-48e2-9c66-9bea6b5dd79a", "indicator--285740a4-4b04-45f5-922f-7a7fa3369814", "indicator--60885598-1056-4f9c-b3af-f1ce5a738878", "indicator--4192fe8b-84de-46e2-a594-67e59522ff40", "indicator--bd1a6d1e-4a49-475c-bd3a-4755542cb059", "indicator--12f12d06-feed-4f0a-bf6e-950c419f54d7", "indicator--4b96b7a5-85e8-43ed-a002-1014c6c790ee", "indicator--14fe951a-70de-429b-986b-2dbd5828a097", "indicator--54d6a285-d5a1-48fc-bf7a-379c6b290f4a", "indicator--68498583-774e-47ad-9c78-03901de6cfaf", "indicator--e07efdbc-afe7-4f54-8fb2-cd707bf1b02b", "indicator--2521f5da-fe07-4d20-8b44-5961944b7435", "indicator--80792e05-f63b-4fb4-8f19-f2a7ccd11e02", "indicator--5d44511b-700a-4a0e-b9dc-9332d9036cce", "indicator--c7817997-695d-411e-a529-39a5cc6b455a", "indicator--4c7d30df-fe2b-4070-9700-2e7393bdbf70", "indicator--269a7986-3433-4ac2-9d00-4e0ee3238356", "indicator--c497a0ea-f7f1-4cac-b7be-905ceec76601", "indicator--73eb1bf3-069f-472d-b76f-bafb91d90bb2", "indicator--1a67e011-51ed-4e6e-b4f7-2df47f182ae9", "indicator--4a57b8c2-e85c-475c-b4fe-584f521ae6b3", "indicator--3fe2bbc6-fdb0-4e48-93a0-2e2fca73c388", "indicator--534d4340-1ae7-41e4-bfbc-9cb42d259402", "indicator--6ad17152-2155-4f1e-8963-77011b835235", "indicator--ad2876aa-5faf-42bf-bff9-b555ac8dcd9a", "indicator--6503b023-2b36-4aa0-87d4-2324b8d10626", "indicator--357a8b68-189f-4e74-99ab-ff091ad7e60c", "indicator--daaded79-38b0-4c65-a80b-375163585736", "indicator--e565cc4a-6f92-4be2-b2ee-35ac956372f7", "indicator--7d0e52cc-1bbd-4343-8aa9-357aeb810c30", "indicator--93727b4b-200f-41ed-8c3d-73cf3af2a656", "indicator--0ba309fd-75cc-4b7f-a38e-81bf041ad349", "indicator--c9a1f5f0-0b85-4ea8-a878-04960525bb96", "indicator--5cab985f-cdf6-47ec-9302-a54a2cf42520", "indicator--28e484a1-d0f2-477d-b870-62351986d524", "indicator--70386d24-074a-4949-8a5d-1af8f82aa7f2", "indicator--6d6d0a9c-5b58-46e6-89be-621e94220b23", "indicator--6885e73d-39af-4f07-a94e-187619f1cbd3", "indicator--49864a4b-8026-49c8-b9ba-679abc439c81", "indicator--13c978b0-1c5c-432e-840c-5e34e8c605e0", "indicator--961a364b-2b17-4380-b0d4-6e710f72498f", "indicator--4c6276e0-7252-4adf-b30b-9b03635e4516", "indicator--2d07799f-b068-43f9-8a13-037ef477d259", "indicator--5b808f92-37f7-4f35-b686-117584b14524", "indicator--8b09d84b-3fea-42b9-b2e8-6d970a725f19", "indicator--87f03afc-bfec-4b5c-b69d-53a9fca61f43", "indicator--74edbdd2-d71b-41e0-b07a-fce2f941fa49", "indicator--231bec0e-e3c8-494a-ba67-b094d9439934", "indicator--a54e2035-47fa-48eb-a3e2-3fa7ca98c976", "indicator--0923210a-7b94-4c79-b34d-8eae96f8b6a8", "indicator--d6700af8-000b-40ab-a00d-515b473b20bc", "indicator--a15c77de-e979-4725-badb-0e9ef2e2d992", "indicator--77a668ae-aa8a-44f2-aacd-f0e9786eb5ec", "indicator--2e6d5f77-edb9-4a67-be48-84b6349aee0f", "indicator--d49c2715-fdf3-44bb-8911-659383ec2541", "indicator--c685214f-8a26-46c4-903e-2a6f219eda11", "indicator--aa920cf6-d512-49ee-a553-1d2c37656aa7", "indicator--3a17bafc-d7bd-4950-a350-fc38972130a0", "indicator--33cf64a0-3c57-4617-bb1a-6a2287699c57", "indicator--f4eac156-a7be-40b6-883e-5b06ec329bfd", "indicator--90b264d3-db5c-4665-8ed3-be0a010cd519", "indicator--ac148ac4-ea14-4f0f-a09c-12c934b30209", "indicator--a0c1ad84-e0bb-4a7e-b94f-61513c33e1db", "indicator--f3b647ad-9667-4a84-bab2-845fbdd9ebce", "indicator--b2254071-7d62-42a1-a456-70f0a87b5f64", "indicator--0d5cf4f4-bd57-4013-87cc-72521fa4e73b", "indicator--28077a75-16e9-4605-bb1e-009fae6a63c7", "indicator--0811b1fe-3bab-4bf3-a463-6da6226c8319", "indicator--10e8ac2b-59db-46ec-a5ea-90a3cf7a4b58", "indicator--a7413426-e71b-4083-88e0-96f74e96cdef", "indicator--9d827f1d-8155-4966-8c77-59d9abcd0f64", "indicator--b4fab8a6-4563-4bdb-82ba-d9e6ee7fb358", "indicator--6bb72af8-0b88-4e45-bd36-86d7dbab92fd", "indicator--155ba809-e9e5-4b60-88e5-bb2216c7eba9", "indicator--0e69840e-62f7-4cce-bfca-21fdb075454c", "indicator--b93aa1c5-bcd2-4730-a8af-f7b4ae1cc193", "indicator--c68660bf-95f8-4d12-8901-222d6ddcc9c5", "indicator--437896e2-79d5-479a-8a54-3eca7f0cb649", "indicator--fb377532-ad40-4343-9e26-b83807c66edb", "indicator--1b3e844a-20c2-4c81-87fc-0a3bf7a158c8", "indicator--bc6706ce-92a5-4ba6-89d1-e28a266f30d3", "indicator--a9a74d77-8a0c-4cb2-b513-8c507262cc73", "indicator--29381691-7106-4077-940c-f8d9197cbb33", "indicator--a0a548a3-2b72-40e7-b94c-8d0c2f9b4d17", "indicator--9b16f14c-14fc-4c37-8c1c-d4cd11ea3325", "indicator--136c7270-2211-4fc5-bb46-dc0359bb8418", "indicator--e3058c12-c9ab-4de5-ad84-c3ef776f38fd", "indicator--2f7eb857-1da1-4e2e-80aa-0f5ae1f92357", "indicator--d6f9d8cd-1155-4640-bd88-b79c032500e9", "indicator--fcca25b8-6c00-4b05-89cf-ebf2bc5fda6b", "indicator--51e583d1-14ca-43ad-b165-0daabf0b040a", "indicator--dcea0eb7-6cd9-4c57-be4b-34df9adf4145", "indicator--8e8425f7-b76e-454b-ac7c-79d90f6b041e", "indicator--d2b67d13-7bad-4503-89fb-606f4bc78af6", "indicator--1070b26c-e5f2-438f-8dd3-6e056fada5a9", "indicator--e04acbb1-e96c-4ebb-8d0e-77a85ec76f79", "indicator--d9fd7a1b-a3bf-4fd4-a5b0-a26f96f98404", "indicator--b28a05c4-01e7-4fc4-8c13-2127cbbf7cdb", "indicator--8a5133e9-63ef-4e76-aca0-8dabb69b3271", "indicator--95d4a36a-736b-40e2-82b3-e7e679da4772", "indicator--87bd88bd-26fe-4f19-bcfc-3e624e6999fd", "indicator--50fb65e2-c3aa-4275-8420-29e59d86cc25", "indicator--58eeea9a-e024-4f08-bbe5-706465b9758c", "indicator--e3ff854f-d1cf-430a-b397-a1df4130e0a8", "indicator--1f1a8962-ac04-4758-afbf-b063cebf9091", "indicator--3cd465f6-4238-40b5-b894-97b16337b27d", "indicator--b0916688-5245-44a8-8456-906726c0a78a", "indicator--9dda878a-3864-4f90-98d4-3ea81b596713", "indicator--3c73a984-e49c-405e-8bc2-06fc0c1de8e5", "indicator--0b72f181-13f9-4c46-9487-c8434d6ff92f", "indicator--c1288330-9cb2-4d14-8272-212bb3c5cd06", "indicator--a27ad36c-5afc-4690-ab13-379296c1cd85", "indicator--1ca7c67a-7742-42c3-b9ad-42f0fae84857", "indicator--e5646965-e5da-4aa0-8748-cf22350644e3", "indicator--6e0c9077-e503-41ca-8fde-ae0112b757af", "indicator--e51363a5-4e42-4861-a72e-d6e14b32a91a", "indicator--a6a22cde-aa6a-4d86-806a-151f730ca0d2", "indicator--c5e23ea5-9e5d-4ef1-9f59-1504e418a31d", "indicator--3b62c722-5fc9-40f2-9b1e-73f1abfe8529", "indicator--d861cff9-7174-40e6-be22-7093545ae281", "indicator--5c2b1584-b0aa-492e-8d6d-2fd8b6e12dff", "indicator--b4bca4ec-c28f-42dc-a466-e48e0115c231", "indicator--c132b9e1-40d6-4c4e-b6ac-91467af97460", "indicator--901b0dd1-730f-4a67-b618-566f56d7d984", "indicator--0dcdbf06-1359-4b0a-804c-c50ac3522e94", "indicator--cf83a35f-0a68-4974-8077-8893bb20924e", "indicator--4fe498f8-af74-418f-bda9-8f592d25b7fe", "indicator--71ec6091-4741-4dac-87ee-d62e5bca928d", "indicator--2ae12fc6-79c8-41b7-b12f-8fa91c919c1c", "indicator--c6b77e3f-329b-42e8-b993-e7fec2a25470", "indicator--ea2e5fe0-6746-4b5a-86c6-6b08d013d0b3", "indicator--707d7a4e-fb26-4b7e-b672-9b2150c41a43", "indicator--3bdd476f-5a8b-4620-bd58-37b574c838bd", "indicator--f00a42d3-98a1-4873-8cd4-98732e602cf3", "indicator--3d257473-dfba-4b2c-ab9d-44073e902bcf", "indicator--c8048546-b2ca-4106-9c7a-cfd47e00a16c", "indicator--59723693-32bd-4241-83b7-6a9fa5f3673e", "indicator--907b83bf-fd66-4dac-aff1-44e773652221", "indicator--ce2cad11-3d43-416a-a3f7-712ae3368b2d", "indicator--9d59be09-2a1f-4f10-84ad-8043d1553980", "indicator--c7e9fb04-facc-4767-9ace-73b3885e4acf", "indicator--ec45e694-5917-4599-82a2-b8e48f61af83", "indicator--7b3fd3a7-43c0-43b8-8cb3-6bfb99f9603a", "indicator--7196acb5-c9bd-402f-9e13-351659231aa1", "indicator--af14caa0-512c-40c9-a4a1-3b89e3d38ea2", "indicator--f9191ed9-2603-494d-bb16-f27a2f550d4a", "indicator--b6b5526c-78d2-47e7-904d-c8e1c7f332fd", "indicator--553bc1eb-8d11-4074-b70c-b7fd4a818c9a", "indicator--5e615267-af6e-44b0-859f-0e892e26be6b", "indicator--7556cf23-6101-4fdf-8a38-1c868c5de67e", "indicator--162c0dbb-b308-4600-8954-e19d31752c0d", "indicator--4d8fb307-0dde-4a18-9e9b-4842c2fbd870", "indicator--ccaf3542-5afd-48a3-8b6c-2e578de4056a", "indicator--4f52227b-f4c6-4696-a2b7-794cd03afb38", "indicator--d4176fd8-76d8-47ef-913e-8aaa6d5bd1ee", "indicator--9270996c-4e64-475a-9e5e-efe35efd5ce3", "indicator--ffda1086-da84-4537-a21b-c62a9ac63cf2", "indicator--e37cb975-5f7c-468e-9801-a6b280b24b15", "indicator--9a9f4a27-8fdf-4a14-b83a-ecc43695bd06", "indicator--0fa2b0a7-8d25-4da1-b013-cffc5b6b89ab", "indicator--f25f5a90-22e4-4bfb-9d03-51a5002eee00", "indicator--3b522554-b5cf-49e1-b36a-34cf8312fc53", "indicator--68f2cebc-5153-40c9-ad97-31859e23a378", "indicator--32f319d3-cefe-4e2b-84ae-b09acaaea020", "indicator--356be926-3fc7-4f7e-8c61-a8ea6a74e2af", "indicator--40162892-9228-425b-bb8b-b6a614d74f47", "indicator--0700925b-e23b-4c7e-9e38-79d0a38a1832", "indicator--1d0eee5c-5c25-4a2f-aff9-d80ef8ea8a96", "indicator--278b653e-80b5-4d31-9e52-ad798bb1c9aa", "indicator--1709c4dc-57d5-4c3f-bcfa-a03b02ce750a", "indicator--eda1d388-7c12-4d7a-bb7c-f34a3d4a1e2c", "indicator--8cf7a1d1-a043-4d0f-94a3-24a7b3118f8f", "indicator--b8154220-58f0-451f-9774-30a1e6d5a23a", "indicator--35abe7a0-6f2f-420c-9fa2-d43b4e359ba6", "indicator--ca37e723-8ad5-4012-84dd-55401c60999b", "indicator--4122a2d6-7ded-4d60-87d9-35465392749b", "indicator--c4403989-7de3-4518-b2cc-af5e4040e46a", "indicator--92fc3682-a70f-44ab-b497-d90961ccdfc4", "indicator--d9b6671e-b506-4bdb-b438-838c0749e393", "indicator--f9815de0-fb1c-4bd3-bc86-a594c7667d8f", "indicator--df21fa24-66b8-4060-b49d-0dfab9258f25", "indicator--f2e382c2-b48f-41b4-9618-b260e2c39e8f", "indicator--d38991b1-20f4-4e19-bfe4-85943db5b455", "indicator--5f70704b-7f5c-43d0-9eed-e94c4dc591d9", "indicator--15eb5c0e-89ba-4aab-8e4c-72aa4e3d7d40", "indicator--c55e80c8-3f3c-4792-995b-c38270a8aead", "indicator--bc848aa3-350e-4e15-9d39-c9a6de379b55", "indicator--46f33760-fdd3-4baf-9906-45af1f714714", "indicator--8b4e64a5-f1b9-4eff-aa6b-248368ef24a3", "indicator--b2af320d-2dc2-4e13-ab9c-4728227c6b93", "indicator--7462a8c0-0746-48ad-a31f-35fc79d4824a", "indicator--d899d266-ace9-4a66-abee-f9ee1054ba13", "indicator--9e9900f6-f6c4-4ec9-b676-788cd407d994", "indicator--e6809489-fc8d-4938-8417-3d0b82c11f0a", "indicator--55fcfa09-61df-4d95-8868-ff48c49b42b0", "indicator--0649982d-31bc-4b89-bc7d-1af7dc94b5cb", "indicator--2e7051f5-916c-421b-891d-ddbd5aa0ff29", "indicator--62529942-ddf7-465c-8cb3-b7df27b03c98", "relationship--11c28ecb-752a-4e7d-94f4-548c43254b07", "indicator--e705fbd0-acc8-44f4-8c22-9c23ddc6beaa", "indicator--eaec56cb-17dc-407f-afdc-b2e2a2f8c154", "indicator--590b0cad-c5f5-4148-a698-84d37ad8888b", "indicator--9b47ef2b-aa98-42eb-821f-4735021449dc", "indicator--62339a0e-79c3-4a53-a8d5-8abcef859270", "indicator--dc815f0d-c400-435a-b7bb-bf3ea031e3ce", "indicator--b50d2583-3632-4c05-860e-a04eff90ecf3", "indicator--067875d4-6706-401f-b606-623db527ae20", "indicator--e2110d13-4fb4-4376-b9fe-0d0c9cb64adb", "indicator--d64afc55-104c-4c03-9f6f-cdc539a7cfba", "indicator--58a3196a-28ba-4ed2-8b36-00a7ebcee899", "indicator--c543ffed-0af0-4cdf-81d2-27a2352c9c56", "indicator--eff15d3d-99df-4b4f-8aa3-680d3a939f7f", "indicator--72149076-4097-48fd-866d-1e7f510a834c", "indicator--a8f75e27-c859-46fb-891b-a8e413ca5641", "indicator--62d61797-18a8-4c87-93c6-244baaefc980", "indicator--299533da-f888-44f7-ab4b-4bb5cb9fa39e", "indicator--a3dd6915-9048-421a-8f12-eedd0486501a", "indicator--28ca0c41-fd8c-4ccc-b772-b0ec23e9dd47", "indicator--6e62fe6b-442a-49ba-ba69-2a750feb24cc", "indicator--ca098cb3-8a2e-4a6e-aa77-ad0014a7572a", "indicator--555bff97-95a1-4f12-92b4-58d170750990", "indicator--1d1790ef-bdfb-4299-acda-54bd3ce6f0a6", "indicator--450dca6e-e2ff-458b-9619-bf74fd50e31f", "indicator--01df6d7c-eaee-4735-b256-7afca5027039", "indicator--cd644306-1a91-4c40-9cbc-53a71d12e36a", "indicator--8c34070b-1df4-4f07-96e0-6fb3c7f4410b", "indicator--235ebeb4-81ee-4f88-b1b7-780c5fdd1e24", "indicator--cac3ef74-1f5b-46c0-b152-2747adc24c46", "indicator--63eddf92-43c4-41b0-a766-b25cb5c76751", "indicator--3a170cff-00fb-417d-8705-cbcf7a409751", "indicator--3008485e-46d8-450b-bab0-efeaf685f4ad", "indicator--5c01d4c3-f323-497e-a02c-4dfdf03e082a", "indicator--69bee908-7fd8-4321-8967-10e1ea87156e", "indicator--87caa76d-cbb2-4f00-804f-2e48ee1ca76c", "indicator--6379006e-92a0-4e14-b379-63d96d380a14", "indicator--b1d8f09c-ed26-4cd8-a0b7-24b96c8c6f37", "indicator--a17f676b-b6bd-4921-b52e-c26bcdedad5c", "indicator--5f34b3fa-6ea5-435d-bf02-4f25b7f6e4df", "indicator--1c8de572-241c-4b12-8a72-e9a10972fbc4", "indicator--bc927ca8-c9b9-4041-820d-0ca31f619ff2", "indicator--1ccc8f67-ea71-42a0-bbb5-dbde1ea2b804", "indicator--e28b60e4-d9c7-4ca2-9979-fdd544610cf2", "indicator--329c3341-1c51-4026-83a9-124a02a193fe", "indicator--f0d8de81-cbbe-4beb-bab4-3be75b560657", "indicator--314d69ca-a78e-485f-9df3-be142c234b82", "indicator--7a40d76e-0876-4517-bd76-f6013bb10f77", "indicator--6047c854-a501-4bfa-9373-f10b21c4eb67", "indicator--691c4b1f-a5dd-42fa-812c-5ee6d3ac5dd4", "indicator--653ac985-ff6a-4d2b-bdbd-2c4b8024634c", "indicator--bea658df-6fa9-4077-a87d-f6b3a89a94cd", "indicator--1b738bac-0abe-452a-8630-29f425a4f156", "indicator--5c71b357-8d8d-46b7-bc2e-47c282486ec4", "indicator--368d87aa-c5b1-4b86-8900-87f3a4b40453", "indicator--5b2ea891-42af-405b-8232-093b297f94da", "indicator--1a0e918d-1717-4032-b53b-8f071da070d8", "indicator--d28fe9d4-9293-43d8-8f9c-d5ddab147220", "indicator--4dc14d11-46c7-4939-bde7-b48098a4974d", "indicator--f31b4eea-c136-4f0a-bd53-6126acbf243c", "indicator--bc4652a0-70ac-47a2-8429-09ed1f646d45", "indicator--13a65650-6116-4749-873a-be4e64984d4d", "indicator--59be663f-6631-449b-8cf1-b30f25e341cd", "indicator--173e10fd-eb7c-48d3-89ca-f5982530fc13", "indicator--cdf567b2-adf6-4184-9a6e-3a52390d432c", "indicator--7d471e67-eaec-43ed-9a51-39442f140d2f", "indicator--65869d1f-bb87-46df-a722-9e13cd7ad335", "indicator--1165bf21-d501-4cfa-9519-a03c132107d0", "indicator--2a2b2071-045e-4997-b37a-b17e23e3e5d7", "indicator--57635d6c-746f-4692-b5e3-da6e91238bf4", "indicator--add4b4e9-30be-49df-a57e-bd312a443dc7", "indicator--a9aa2013-9d97-4c6e-86e5-2d2116445801", "indicator--bb5933ef-10b1-486d-a5c3-b2e7328d0181", "indicator--b7929611-b4ba-44a5-9046-6a2ac8ac611d", "indicator--2ce654f4-cb2a-4feb-8cb4-a13607a2cabb", "indicator--47ea75d1-bc42-431d-93a9-c7f86cd8a517", "indicator--0a2ba099-2650-4ddc-8f92-7ca250abe739", "indicator--aeffc54a-326a-4bd7-8c5b-75085a703341", "indicator--fa638b8f-9fea-48c4-bc4b-ba8e0ebdc162", "indicator--515e10e3-5b2c-4e58-8136-dfd94525505b", "indicator--143a932e-7ce7-4d29-a62a-a67db2a0bf8d", "indicator--94dd8b22-404a-4a13-a574-afe3666ec979", "indicator--81130dff-e104-433e-b3ae-40854b5c726a", "indicator--b46000cf-7829-413c-9c02-b1a633a2af84", "indicator--997f6827-b3a3-447b-a727-f376e676588b", "indicator--a9c137a3-8363-46e0-8707-5b6157c0b7d9", "indicator--e7bd29f5-623e-4abf-93a9-8c251838ddc5", "indicator--f1de04fa-d24a-45b9-8fa9-bcf87d97b5c9", "indicator--38ed1fd8-4913-432b-a6a5-accf98cb5653", "indicator--f11ae55f-0beb-471f-ad54-c45614786fc8", "indicator--8e660bf4-1da3-44ac-b8c9-244bb9d14655", "indicator--2f808885-9171-402a-bad2-6888a611891c", "indicator--2dd899f0-6933-487f-a514-0a305bd4b4a8", "indicator--756bf504-d259-458c-8ec5-5c453338a55b", "indicator--d738e354-e370-4ad8-8546-2adb2278356c", "indicator--459aa3e1-9496-4ccb-a7f6-6911371d6d2c", "indicator--864a33ad-f080-4989-9792-d19653e0879a", "indicator--d4e97e22-744d-42e6-9d30-82d30c425094", "indicator--0b92efa1-1912-4051-9511-484dfcaee4fd", "indicator--8c61a7f7-10da-4978-9d01-efbcc7c388e6", "indicator--5fb0e2d1-6645-4d9f-9e57-34e9e63ba4a5", "indicator--764b5bb5-cca5-4bc1-847f-aea14069ec7c", "indicator--16012ceb-8b27-4ef1-b8ee-28cf1d5f292e", "indicator--b831c788-f30d-4fdc-9baa-ac902638789a", "indicator--9db6a0d9-77e6-4842-a856-d18c5413be73", "indicator--2e2bb02e-d4c8-41b7-ba03-804dc1635aac", "indicator--2e21782b-c38d-4010-af67-b0a5748a09a3", "indicator--360de330-f639-4a31-a09b-72f6bad08e74", "indicator--b1f96848-65a3-445d-9e30-8754f32e09c1", "indicator--d2242e35-ddb7-4264-973e-405080b68765", "indicator--ff9ba31c-e7a3-4a4d-b1cf-f863c5b7407e", "indicator--8b8905f6-f5ec-4008-9ed8-8a31af343965", "indicator--65c46c9a-7d0e-40a9-a37c-c1962105e6cc", "indicator--44af3542-7914-4d2b-b67a-cd8ea4fc9a57", "indicator--ffb25202-ac9d-40a9-b2b7-ea37ae0a311e", "indicator--febd0eaf-62b8-47ce-ab6d-c3343206ecaa", "indicator--44c057a1-49ee-410a-82ca-da93bbb8d6e4", "indicator--0c92cc49-ea8f-4b22-8ef0-27a898e500ae", "indicator--deec25bd-812c-4fc5-a9d1-ff802e8110e1", "indicator--137f0801-1a4a-42b4-b205-d994ecc06c07", "indicator--80d987b7-5541-4b90-ba2b-fea7c994b84f", "indicator--5641a692-bba6-40e9-89a2-f3c59b6e9a16", "indicator--9b0fe644-899d-48f7-80aa-9fa315fe15f8", "indicator--a380fe45-b38d-4d81-bef5-20c28d7cb095", "indicator--c3c10da5-42c3-4874-bc79-4f77cc6f9c3f", "indicator--d007b960-9fdb-4992-9223-654f649046d5", "indicator--c2f218b6-2359-4659-85fe-2ac519408428", "indicator--bca96b8c-f9dd-4457-b091-e635ed321a4e", "indicator--2744aeeb-4b7d-495e-862d-59c0c9c9e6fa", "indicator--4a1b97ce-b356-48f6-a7e5-0642d6f4390f", "indicator--3b1b2750-8a86-4e50-97f7-776b8895c1cd", "indicator--f6d29bea-1b42-448e-889a-b129a444ca21", "indicator--3a439422-4018-49c9-a4c4-fa6bd82e2318", "indicator--f5721520-4815-4786-ace5-7e18c36dabc4", "indicator--2cc1aca3-1665-45f0-b46c-526264802333", "indicator--83fc01fa-0dd5-41b7-a3c6-ed6d1a8d0d08", "indicator--779cb795-a704-4f38-b747-767b3339b827", "indicator--49c725c0-ebe4-4abd-9880-472d3f5ea77e", "indicator--b95325cb-1f95-4a93-a62c-aa65e663c4c5", "indicator--ea3da258-ff22-46cd-a6b5-bcebe75a420f", "indicator--e9f69428-0a11-40ef-8183-f7c350df5320", "indicator--8c9faef3-11c5-44eb-8d65-a2a1e9104e51", "indicator--15c59d3f-9eac-44e5-91bd-6b24947b9700", "indicator--cf1f4425-ee16-44c8-a1e3-05dc42b8a2cb", "indicator--964ee1d9-2bf3-487c-a228-09768a7e0c7f", "indicator--42e65680-197f-4d61-89db-c4c6bbb894a5", "indicator--c2e80921-14ee-4a44-b032-4be0db77d3f9", "indicator--64119b57-ad89-48bb-ba43-f1ea2b8c6e79", "indicator--5cb22394-789a-4b9f-ad3a-1f878fbe83c3", "indicator--447bbce7-1b97-4bb0-a2e7-adb7449a21f0", "indicator--3e0ce351-ac6a-48c0-b477-d0bc973e391f", "indicator--9ac93261-e7c2-44b5-a1e8-eb387a36b134", "indicator--4a7276a4-b2be-4c3b-94bc-21e73561c84f", "indicator--631eccad-e0aa-4651-b029-7bdac8fbaa97", "indicator--c99e1010-8adf-47a0-bfec-e6d91d30aa99", "indicator--4fa87e41-8254-43f1-bff0-f52b7c7dc0cf", "indicator--5cfa8aa5-57ea-4ec5-b674-47608c071e07", "indicator--7637c631-886f-403c-affc-ef4ffeb1e81b", "indicator--c6eb4671-abf6-4084-9234-b863b8493397", "indicator--0356bafc-f434-454e-88dc-2286f53ff4ee", "indicator--e1774bfb-e78f-4055-bc89-7d6d8c4013b0", "indicator--0041157b-7dde-4237-b3a5-063019e263cd", "indicator--1e42470f-c4b4-44fa-8ca3-b0de540dfde9", "indicator--6888a863-4b4c-4c74-aeec-c59d7315936b", "indicator--e6d63300-8a3b-4866-b4d3-e89d5900acd6", "indicator--aa63c4f8-8520-4e64-8baa-cc32e88a7e57", "indicator--1621489f-42c2-4941-88e1-fa68c662d2ee", "indicator--c99e4189-e04b-4845-ac14-a3949851ac77", "indicator--97489361-7334-4209-b22a-d3737bc36535", "indicator--3292f30d-f7b1-4990-ae81-cb5196e241b9", "indicator--7481ef4b-8959-42e6-a4b3-d59045880935", "indicator--d2e933ad-7c4d-4bd8-aa87-eea68f16eb9e", "indicator--68c7d1dd-6a3f-4589-88d8-3a0d8e1b54ed", "indicator--8e04ca10-8075-476b-9cdb-ce87637c0f1f", "indicator--6e19b425-9265-45ef-ab5b-70f3a4f063db", "indicator--0fec2481-c4f1-40b0-a614-cad78c4241b5", "indicator--b88c7c67-1abb-40c4-9f06-4ea4eeaccc30", "indicator--422f6dfc-689a-4e8f-82e4-9166c8843c04", "indicator--23b8cf60-3e23-4b35-9c44-56e59d07c1bb", "indicator--f0cf19b1-a671-43fb-9ccd-b9ff44a43ec7", "indicator--135fccdc-2a42-4c6d-85a9-8adadf589f8b", "indicator--d578b24f-53ff-4e08-9494-22c4377cefcf", "indicator--3b14f2eb-1a30-4d90-af25-bc69ded26def", "indicator--c14696b3-39aa-4c8c-99f5-b8cb808a3c49", "indicator--cf1e0310-a3aa-4251-b636-a0faba23e0de", "indicator--e18b7bfb-5adc-4bf9-a7fb-ccf78f53e3f9", "indicator--1f34f294-bdc2-49c7-a9eb-020970dfb393", "indicator--6725d1d6-5432-4307-a98e-b7e978fd23c6", "indicator--ac600790-21c5-41c3-865e-0b1618245fb9", "indicator--6c1de0e4-cb3d-4bd9-b3d5-2430253c98ff", "indicator--c92551b8-f28a-4949-bb7b-25de0fd20338", "indicator--5a1689d3-da58-4936-b456-e0b0e7451317", "indicator--aadf06d4-b302-4ffa-b9d7-8debe9e9fa9c", "indicator--9cdbae87-3a53-4cab-820a-3c9ce9b78d49", "indicator--d0739aa5-f1f2-43ae-8a44-001a88f2bcda", "indicator--8ea9684c-d6d8-47f6-9aa5-c892e2103d4c", "indicator--f1f5b36b-373c-4250-bb91-fbeb87841838", "indicator--64c9b081-abd8-4343-84d5-3fc95e11c9b8", "indicator--91df94d6-bd88-4f31-a3ec-5316d150d1e9", "indicator--9dec430a-5e34-41ad-9b4c-49f50833eadb", "indicator--338b4e4b-9b00-4ee4-bfc7-fa72de1e5a81", "indicator--14a7ba78-7450-437a-bef1-a365f3775d41", "indicator--19a5c31b-8b49-405b-9e95-2a6f4eb78a84", "indicator--1bd26bc0-2e22-45c1-9b0e-5cd95dc63081", "indicator--0a9957c0-7d8a-409c-830c-1bf537eb256e", "indicator--3cf8eb5a-f5a7-4fdb-bbab-19a64d34595b", "indicator--2ecc65a1-1830-40d3-b3ba-62d029913663", "indicator--35541a29-3e21-49cd-beef-dbab9b61d945", "indicator--d08711c3-01b4-4645-beea-c35a32cadf59", "indicator--a6c6356b-1204-413d-9f2d-7faa0dc793c9", "indicator--10355b48-83fd-4684-ba43-02c2825fb3f8", "indicator--fcac31a1-9164-4208-86b3-59dc4fcbd1e3", "indicator--1419a21b-22fa-4182-ba5e-a637b5575e0d", "indicator--19d632a3-7c6f-4f89-9428-9dddef7a0bc2", "indicator--df9ddc63-6d6c-453f-b550-8f5bdab438ae", "indicator--8b981663-92b3-482a-91ba-804a7c12d1cf", "indicator--a7cb213a-7898-4fa7-a9a6-8633d2c5bcde", "indicator--a6cc5693-87ef-4571-90b7-c49a957b9a84", "indicator--4f16ed7f-4a9c-4b55-ba2d-b9fd0f8a4ac0", "indicator--9e90a16d-ce0a-427d-a7db-d2ebc5afbbae", "indicator--e522521b-e8bd-47c8-a1a3-eee4cb0a043f", "indicator--80ad4bdb-d851-459b-a409-fd62baeff6b8", "indicator--ae1add67-ade4-475b-b547-f9ceab92dd8e", "indicator--1e2723bf-45ac-4cbf-9e96-550023ea0713", "indicator--8b0a6657-393c-434d-8d7c-1ec8891d5f9b", "indicator--8976d281-8bed-42be-b7c6-89a4354d87b5", "indicator--c9c1918c-cef9-4a5b-91c9-e99ea2a64a4d", "indicator--e6f3170e-f663-4569-b1cf-654b4a446060", "indicator--6826ad69-a0e8-43f2-9d37-5b67ee1d5ee6", "indicator--1a243814-0546-4bc4-9400-4d05a2328dae", "indicator--a026f1bd-1e97-4504-ae4f-a2e41f26652d", "indicator--eb5e7305-b301-466e-8421-2f110faaf3bf", "indicator--ebe58a3b-9607-4ba0-93fa-dec8ceef07ba", "indicator--6f19aed3-38d6-4cab-a9de-4203ec8116ba", "indicator--53efa272-6cb2-450b-9456-f3b6c9060154", "indicator--137264e0-ac36-4c9c-a6be-f0ffa3cfe3b2", "indicator--dcf871cf-32e1-414e-995f-a2bba60edd7a", "indicator--a7bf8085-80f5-4cef-89d4-984020b01136", "indicator--e0330c83-58fe-41dc-b50e-c76c6c853b09", "indicator--09985621-60c8-4934-b740-45e677ae95d8", "indicator--0e073a53-3c61-4fd2-bc16-18b765b315e3", "indicator--a1cb03ff-b5dc-4c3e-b625-3f3914d08d34", "indicator--bab3943c-4abf-4408-85cc-348a2ef3a7ff", "indicator--3e98f383-a0a1-414b-9fca-09a3111fb63b", "indicator--5dfbebc0-863b-46b3-aaf3-4c650249b350", "indicator--bf8bb9de-52b5-4e41-8e35-115c9e505f48", "indicator--192f7650-db6d-454e-a9c4-fbadc62636a6", "indicator--d4abd532-90bb-42fc-81da-af8e1a7d35b7", "indicator--245b1d7f-2a52-4030-a20b-6809e2588532", "indicator--f219ff42-aba6-4409-a024-9182199038e5", "indicator--c21da455-0ac9-4c6f-b19d-7546855c208b", "indicator--f291623c-34d8-41fd-b37a-6c1102a43bd2", "indicator--6dccd274-f081-4f83-9402-3f3c6b565da9", "indicator--5a730efc-b8dc-4148-89c0-a0ab560bd316", "indicator--326b4d0b-51fa-453b-bbe3-0fb26bfad071", "indicator--9fa2aaa3-4329-4a02-8dc0-a70ca86b7826", "indicator--791d9ca1-9843-44e8-a0e3-c59fc777374c", "indicator--8bcc63fb-1c0d-4c32-9a8e-24eab4410528", "indicator--8e3314c7-702a-40c4-8846-35a49cc9eb68", "indicator--e3eb233a-0425-4ade-b3d6-05cdfb6ead82", "indicator--4c23c4fa-a311-42e4-83aa-eeda855b2ce3", "indicator--0e87ee41-44b8-45e4-86f1-2fcd447157dc", "indicator--eed6b5d5-8b92-4d00-aac7-4a54b266177f", "indicator--6e094608-0daf-4aba-a734-11ef163423ca", "indicator--30a1b50f-1b48-42a0-8a05-305eecb108d0", "indicator--bf027123-cb9e-47d9-87bf-f32f272fc0bf", "indicator--70f9b2e0-3046-4df7-acf0-be1c18c98d13", "indicator--dab9a7d6-4ed8-44e8-8077-0f35871e7e55", "indicator--a731423e-2685-4bb5-804d-95425aac6def", "indicator--e1138f51-334b-4793-93ce-9eb792d4ddcc", "indicator--ef11185b-1dd2-4357-a849-5b6929dcff47", "indicator--713b4e48-0ba3-41d5-9612-8d8d593b3bf5", "indicator--ade5f7e8-106e-4f19-a9a4-e0480eef89ee", "indicator--9c2152cc-8aa8-49ec-8e83-47f5522f6309", "indicator--5ce4d93a-32c5-40b2-83f3-b12f64a93bf8", "indicator--0d504bf8-3136-45d9-a418-2cbad870e3eb", "indicator--410829ff-0462-4ad3-9e10-d28e88c30aa2", "indicator--135bb335-af04-491a-930d-666fd0c4a8f4", "indicator--d40a194a-68f2-45ac-b6eb-5e66f3010d92", "indicator--9eb79925-950e-4389-9912-bfb0a9726c0d", "indicator--2ebc2db8-8fc9-4dd9-8bfe-634a4db5309b", "indicator--bfb4591f-868e-414e-aba0-f7f7e658cc25", "indicator--0e0810b9-9a78-427f-9b4d-c2566ecadc52", "indicator--074b3a25-07c3-46d8-b8f9-32c3ed5c8990", "indicator--22ca1914-b093-44d2-a82b-8e10cb71be90", "indicator--035986c3-fb64-4f03-8094-0aceda61f8f8", "indicator--27a3aa7d-0dc6-4766-8738-61fd970139e2", "indicator--af59bb0e-9c69-4436-8964-406e8e241023", "indicator--1b6b9606-b4db-4d37-9140-62a621d6a31b", "indicator--862c7d36-c40b-403d-8d7f-5dc71c0fcca1", "indicator--5b03e2ad-b5dc-4ca2-b614-3e9b485fca73", "indicator--f47a922a-916b-44c2-a510-a6e913ace3f2", "indicator--890ca897-2a2b-4421-a46a-40bc6483bfa3", "indicator--65ea93cb-5cc9-4ce3-b2ee-4789e199cf9d", "indicator--a0807655-252f-4f2c-a6a2-18da114c7b52", "indicator--2dcb1266-7a94-4c76-94e9-a36da46cca39", "indicator--c53182ba-758c-4372-9951-705fb44bcc9a", "indicator--e9b42e05-b259-4521-b789-ff0336da77a8", "indicator--1d7cf08a-d40f-47db-b1e7-f9c0b2cc656d", "indicator--8931ad2b-c927-46e9-b27b-375f4d008523", "indicator--220b97c6-50ac-4b06-95ea-4df5b2390c54", "indicator--d745130e-6832-4171-8fad-2a5ea3a68bd7", "indicator--0144e32c-e910-4aea-9a72-1eab5be5ebf4", "indicator--c9406fec-60e6-46fb-92cb-b647fdc7e477", "indicator--e74be9d3-3c5f-490f-8a16-bc1fd7ea170a", "indicator--e0d6b285-3588-483d-addd-4a0713a66b1d", "indicator--976a0ee5-e51c-4778-bb46-7149ebdd68a2", "indicator--3ae9acaf-17f2-469f-96f2-81f428c7cd46", "indicator--0146485a-e310-4f7e-a0b0-678b0e7e7652", "indicator--c82c2ec7-d6fb-4eea-9ceb-82f71238e02f", "indicator--7faac5ca-5144-4ccd-91e4-4f85437b8b3a", "indicator--09663dcb-8f4b-4db9-a9e6-67662664d654", "indicator--2bc9068a-560b-4e0a-b890-06da68501f8e", "indicator--55508f14-be2e-4765-9da7-2ffd378d41eb", "indicator--e55e45d9-c5ba-4c8d-9347-492db07d0d87", "indicator--37e16594-52e2-4e13-9429-400b0bc7baf0", "indicator--7792b341-0402-4d94-8aa3-876170175cb9", "indicator--669306ef-1813-40ec-a8a1-5ba347070e8d", "indicator--f3dd5097-f6d2-4d15-b2ca-7615dce7eb85", "indicator--3842423c-2a72-4685-986e-5199d17e52cb", "indicator--c1514fd4-da42-446e-87cb-c0e93b66d2a1", "indicator--e58e2b52-d76e-408a-a710-c743817a166b", "indicator--85b5866a-f4ba-4736-893d-7a9cb9fdd815", "indicator--8de2d2dc-7766-4bf3-8349-1abd72e54764", "indicator--3adac008-16af-4c86-b71b-47ad7c0bea7b", "indicator--f0734bd6-020e-4c03-b084-541ba0f28f01", "indicator--4b4b37f8-f325-4c64-b97c-5e4e3b1d66d0", "indicator--9aca7553-e388-4dec-b1c0-43b3ed5500fb", "indicator--d16720c9-6f2b-4cb6-82fe-d85935a28dca", "indicator--a8b4a939-1a6b-45a7-86e0-9627712ede91", "indicator--6c32eb0f-2120-4a4e-9712-baea92c9139f", "indicator--45dbbb93-32ba-46dd-ada8-dc060d436d7e", "indicator--5bfedf1d-2f3d-41a0-9951-718e36016396", "indicator--7c60f288-ec92-49cb-a574-6f1e046c3f11", "indicator--e67ea558-9ddb-43ea-a071-662a6b420a72", "indicator--8e113155-c626-407c-bc81-b28081686ac4", "indicator--91a1a313-e771-4f36-b5cb-1905e388371c", "indicator--97021dfd-07a6-4486-882e-df0cadfb9b55", "indicator--dec87313-07f8-45fc-9511-93c4446816de", "indicator--88644532-db54-4065-b77c-3d63d8018368", "indicator--8c857bb0-82df-46ab-b6d1-2eacf7134f21", "indicator--a13bbe60-81dc-4ba5-87d7-df0cbbdf511a", "indicator--de492dc0-4e15-4430-a368-9c8be2ab55f2", "indicator--ce06b6be-404b-4564-b682-3dd003ff46be", "indicator--5ef7feeb-c0f9-43eb-a4b6-93a4898591d7", "indicator--1669a25f-55d3-4a2c-a80f-ee3e0615249a", "indicator--1b85b833-c7c4-429f-8577-94c5b37feb83", "indicator--77b90174-c9b6-400c-aade-5e7a3dfca21e", "indicator--b88c63e4-a83d-4865-9cb8-11b9cd3b28f5", "indicator--7eab23df-33de-431e-8b73-2b9ad0748bd5", "indicator--cd6a1ddc-1fec-4994-bf1e-72d928c939be", "indicator--5e129be0-e99a-401d-9e69-1f04b68d3fda", "indicator--47b31a03-0b52-43e2-9993-dfa77a33717f", "indicator--01636921-25ae-472a-883c-16a3c904024d", "indicator--69afad08-be19-4b7e-b23e-9bd7dd7713a0", "indicator--c4ff4e9f-63f5-4a16-9e04-3cae6862a2e7", "indicator--62055634-1c07-4dd4-a78a-7f75867be3fc", "indicator--781d8df5-978d-4e3e-8b14-9c5142809805", "indicator--8c1821b0-a5f7-4e49-9a97-d4dd07af7aba", "indicator--9d88b6d3-2218-4cc2-b2bf-f48acab99594", "indicator--550e0990-cf70-4175-8369-c645a018b76d", "indicator--140c8df2-a4d4-4267-b02d-b508f101b5c8", "indicator--794251c6-3925-4baa-b37e-d82d72c76889", "indicator--df454bd7-292f-4c44-849b-1ee287f954cd", "indicator--a252ccf5-2390-4720-97a2-afed129ab851", "indicator--0772b045-7e52-4487-9a8a-31812f0fbdfe", "indicator--af0a7553-302d-4c04-be3b-9055b9107324", "indicator--47210d7d-c41a-4a7a-bf52-91ad144c3437", "indicator--a77fdbd5-b5d9-446b-abf5-34b14c523a80", "indicator--ff0492eb-70a1-42f5-b5e1-ff6d2d2410d3", "indicator--816a3c6b-ad68-4a76-bdd7-b1f783349049", "indicator--19dd8bf6-81f1-4795-9300-66ad5ff9ef5a", "indicator--8a88fa33-f29e-45eb-8885-c7e41108f14c", "indicator--620b6d7e-7ac9-417e-a1c5-8f8427c133ac", "indicator--966b44db-9248-4973-af12-9b8665d2c1f5", "indicator--fa6a5aeb-6df1-4375-9a99-c4fcfaa56b69", "indicator--d8f738be-63cb-4def-97e7-e477cc3b46dc", "indicator--da7b3825-7568-4b52-929e-5b794a5fd6fb", "indicator--62f445b4-d214-4782-a4c5-627623adb108", "indicator--c7072fa1-b43c-4a25-b110-ee5e313c7a72", "indicator--4df6f7f4-099c-4242-b173-2e8c25fd20e9", "indicator--f4d943a4-8ae8-47ab-9916-d26c342076a4", "indicator--ad2f0113-e11b-4160-aced-2cc8938ce5e5", "indicator--33697cbc-06e8-46d4-aaa0-2bdee4b091ac", "indicator--e278b0ca-fa4e-40cf-beb1-0c964035dc74", "indicator--e1240397-969c-42e7-a9f9-a6f3bca08765", "indicator--e5964635-3316-4471-8698-aab6128ed8ce", "indicator--7494a5eb-ab1c-49b2-9842-efdc15cbc6ad", "indicator--d8d95763-a527-4fd0-a2c6-b50a01c64ff5", "indicator--c368a7b8-0563-4f21-8078-03352817a453", "indicator--a0534add-59c1-45fc-800e-cdf25d758956", "indicator--f9510de6-92cb-4de0-aa0f-20de0c624ee7", "indicator--64095ac7-79e2-4a95-a8dd-f813e194d922", "indicator--1cf60e8f-176f-4a86-b926-62199522218e", "indicator--c52bc589-cdc8-4157-abbf-3f78cc3e98c2", "indicator--c64ba8cb-b034-4128-93ac-c139663c4db5", "indicator--336bd8ab-ce08-43b5-8337-b7384c17964e", "indicator--37e1b5d5-20c9-492e-8a96-be3f39812e85", "indicator--81b4b028-2e02-430f-a606-a4b1fbe3906c", "indicator--a200dc04-f973-43b9-8a6d-0346c4e3df3b", "indicator--b18a2253-8b11-4965-af8a-f9af82af8b75", "indicator--89a11a4c-2197-4410-ba5e-e09d296e3467", "indicator--bca47a05-c41a-4f0f-bbb7-e2600a2d91d9", "indicator--3389622a-7978-4015-a3fb-a0a95ea27661", "indicator--d165e815-083e-4065-962a-3cf81ece22cb", "indicator--d161d9a1-d7e5-44d2-896f-76e0729e477c", "indicator--152c1ba1-d816-432f-96e1-26796397f6a6", "indicator--f94ae6e4-1216-42b9-83d0-f8278619c6a9", "indicator--dd34cddf-2e90-4fa4-a40b-8fb60766f86d", "indicator--be14e7f8-b6b0-4b66-b1b4-edb90db76362", "indicator--475c3d3e-2297-4195-bd0f-147e7eac34d9", "indicator--ae9a8aa2-c32b-4ae0-a1f2-ea0c8b50e8e5", "indicator--776ce16d-fc63-4cc2-896b-4fb925843f68", "indicator--cca4b64e-9a4a-4ec7-93d0-cf8372d57645", "indicator--8d7e9961-bc50-4f23-928f-c1fc0d9f2bb8", "indicator--45cae49c-44fc-441e-80ef-234ed5a6e7dd", "indicator--81f5a674-dbaa-43a4-808c-3b0953cec07e", "indicator--5fee21eb-3ac1-4e71-a62b-14fe0d664293", "indicator--c42a92a3-24ab-4042-a321-a70245af6bbe", "indicator--acf37171-7728-460b-a89a-53a1780c3628", "indicator--e37090c3-3383-4501-996a-54b5de35344d", "indicator--e64cd160-1bdf-4c7e-9220-8093e16bad23", "indicator--f34477fd-a28a-483e-8ff8-0efb4a6ce749", "indicator--48a3454e-6414-4c2e-8e30-99b22288769a", "indicator--bad44a34-1451-498f-97b6-1e640f85183e", "indicator--82bc86e1-5671-477f-b4d0-1e20eeed2604", "indicator--9be8822a-9d73-4ebe-80db-7ca104630450", "indicator--d79e5627-a9f6-4843-adb9-b7f6fda430a5", "indicator--9cb29638-bbc1-4936-bb6e-aae902bdebf0", "indicator--97f610d5-04ca-4115-bd6a-a4c09f57a4a6", "indicator--099dc12f-ab4c-4f40-a073-958b88556c61", "indicator--d5e4df6e-032d-4f81-9892-1d094c837244", "indicator--dbb09b8c-0d10-40e6-abec-08cb9a5cdf1e", "indicator--f2552f31-19df-47d1-a8a9-a10ba840a0fc", "indicator--373cbbd4-04c1-451b-83c4-27480b7dcc7b", "indicator--59f41f11-c78d-4629-938f-1591a6f06602", "indicator--0b9f3ee4-c8df-41cc-8b5a-1407c9f91970", "indicator--d3a779f9-419d-4d2f-a4db-91215e110b7f", "indicator--c970c8ae-8de0-4f3c-8632-784bc4c79426", "indicator--88fe9d36-b749-498d-8607-74d0a9f0f8c3", "indicator--ca24c776-4e0b-48d9-a432-eeec5b2ae42e", "indicator--16580715-c702-4f5a-ab44-19e7bd793d40", "indicator--57f049a1-2209-4795-b128-3e16d6a58d2e", "indicator--e1f1e3f0-0738-4ac8-beb3-698aab889000", "indicator--5889fb02-642b-4c71-b661-e9d9f2bf1f58", "indicator--70a194ed-8a6f-48c3-ae01-2f4dc803fe5e", "indicator--d23a87be-24c2-4d28-a640-a680ec15e178", "indicator--18e0ff5c-e78f-470f-affa-c57c4dab59e1", "indicator--97f7a984-31a8-4e4c-b22a-e32344954e6e", "indicator--002f69a3-e4a1-481a-a4f3-dc56e79b6bdc", "indicator--a6b68bc7-5662-4eac-bae2-15049e24f677", "indicator--738f6083-a95c-4b17-9ba4-782b5e021a22", "indicator--5cc3143e-8ee8-42b8-804f-fce0d8248588", "indicator--ff17139f-27a5-4a21-bb63-95a13413bc1b", "indicator--8956df17-1c80-4202-92cb-0aacfa56ecad", "indicator--3c2de1e3-ab93-4226-a87f-c22b6d25a515", "indicator--8ec38c0d-3df4-443c-8249-89978360a7e7", "indicator--e2fd70ee-07ef-4b77-a7e2-827679029dd3", "indicator--b6ad152d-6893-47f8-ad2e-e6a317b524d9", "indicator--0fddcc04-1f11-4475-8c57-9e7ccbb82d0b", "indicator--d1c5005f-f66f-4af6-995b-b0a67504c2db", "indicator--090d586f-fd64-4a93-bd4d-05829dd35732", "indicator--17b8d76f-6cb0-48d2-8e2c-e5b80372157f", "indicator--3f9c715c-420c-45ea-9f00-3a0c08392bb3", "indicator--8ac0a558-ec6f-4dd2-8035-4e7312ca8b9b", "indicator--ec93b908-d0b7-4262-b492-d4f691be119f", "indicator--098ddd02-b0a4-4539-8c44-88f712b04d1b", "indicator--4d426f7b-c3f2-4517-bbbe-e895fd96216b", "indicator--83b6e7d7-577b-4bd9-86a5-13a000066c1b", "indicator--6e842171-7066-45d2-a163-e33bb282befa", "indicator--83469504-197c-484a-a749-3461434974aa", "indicator--19698c72-52bd-425a-b973-cc801b61dde9", "indicator--bbce3109-a41a-4a8d-a953-14f852934648", "indicator--9fa0b587-9c7a-4a64-8d0c-a5d7ab5764fe", "indicator--ba03489d-20b2-484e-8b4a-0663bce34149", "indicator--92f8d45c-6d5e-4f2e-b2bd-495d183b435c", "indicator--f6ec4f07-2ab0-4d6f-96a2-21854bbd4660", "indicator--e7219759-202c-43f3-a132-c99b5a7fc07a", "indicator--c79e21e5-d8d7-4ba5-b256-5f1a2cf376f3", "indicator--13a23f91-ea12-4aec-aa24-e54732a4ebb6", "indicator--e3d879b2-0d5d-4f2c-b253-54d3211070b5", "indicator--363bce6b-cd6f-47b4-a8a7-32cf9b7c319d", "indicator--3c02bdd0-e067-4cf5-9327-c6a620686870", "indicator--a01d2fb8-cc57-40ac-9efd-06cd0b475516", "indicator--ad23784d-ffc9-4013-ae9d-0cf77583de90", "indicator--1799f41e-116e-493f-b380-f3f3a46f31e6", "indicator--fcbdf101-6cc4-4aba-acbb-bae089f6b5ba", "indicator--734543cc-7e41-4699-9077-f2cea762b45a", "indicator--3a7ace18-ce41-4fc8-a293-e26dab3149d3", "indicator--7073f220-0a6b-4c11-833a-d02c0bd98c85", "indicator--3b19b4b1-48d5-45d9-8eb3-7c9c641fd29d", "indicator--cee7287e-36e6-4a56-8d95-e3d9256e5351", "indicator--bdc2862a-ef62-44ff-a4b7-87a191154deb", "indicator--99d0410b-745b-466f-a838-9400fc4dd79b", "indicator--17af088d-b1e9-4fcd-a1c4-5ed09e24373e", "indicator--4cd4def1-8272-4d52-8899-184789aed123", "indicator--20c92e52-f9fb-4ecb-bcbf-64e36f377c6a", "indicator--18987098-a7f4-4cb5-b60c-dcbf7a9642b0", "indicator--e2d281a3-3e26-4c11-a521-7ae8f90ad588", "indicator--d18c28e1-d3c2-47b9-8ede-af1bdf051aef", "indicator--cdd3e739-1440-4ad8-837d-6378a2794dbb", "indicator--2c7a9536-a445-4eb1-b982-d9673a3b85b2", "indicator--f41d20ed-0b32-4f7a-9da5-bcd4cd986904", "indicator--dacd9b8c-a3a4-4574-9938-c702d56ba22f", "indicator--ad433d92-7c53-4b3c-b8ad-2de75695fbeb", "indicator--fa802972-6c82-4589-8a52-98a7262bda5a", "indicator--610aa701-0dd9-4c15-a1e7-9642fed6a1e8", "indicator--49f3cb52-9315-4ef4-b89e-b8ffd961c60e", "indicator--0391e3f8-1569-4e6c-b3a6-cfc1863e174a", "indicator--f3627692-57b6-42c7-9850-e62e255f05fb", "indicator--bd7208df-3809-40ef-80db-b70645d645de", "sighting--29322fa5-d257-482e-a454-afc4c5cf543a", "sighting--d583cf16-bdc4-4934-b7ad-a8a36e575c70", "sighting--96216d8f-e49a-468c-a24e-9b3694cc7439", "sighting--8d689455-9c61-4f1f-b357-7b6712ceeff0", "sighting--00e1dc0c-e4f9-417a-ba83-221a4bdddff1", "sighting--5cb14e10-3caf-4371-b48d-488c501c82e6", "sighting--3a917a48-29f1-433c-bd53-1b760ee00b2e", "sighting--14c1f648-2fa2-4de4-b2a7-f8c645b791cd", "sighting--2452bc27-79bb-4c8f-a4cc-a7071aaf4bc9", "sighting--a48f4a1d-2d18-40ee-b746-aa63b23ed5e6", "sighting--f288fa60-f0f7-40fc-83d4-031c04fdb1d1", "sighting--75048d39-6bf4-490a-b373-18097e567061", "sighting--238b4e46-3cdd-4f47-b696-114217b43343", "sighting--53f6cea6-5e95-44b5-a2af-4f408a95237e", "sighting--1d3c26eb-37ff-455a-b441-956b3d893334", "sighting--02ec1f97-46c7-4cf3-8092-08cbac8706aa", "sighting--2dd6cb48-98ae-4b1f-9433-782451f3ab99", "sighting--15f08ac5-b8b7-4b61-a8c1-4565f7b16051", "sighting--957fbaf8-8e35-4046-a883-f2cbb2a6e53e", "sighting--8e42f940-866e-4db6-b0e7-5a3e696d918c", "sighting--31ba82a4-5b18-4045-be28-1cdf428ac83a", "sighting--5b774912-9231-43d7-81b5-d43aa5f77c6c", "sighting--8b5a89cf-1c4f-4526-b2e1-a81a429dda49", "sighting--4dc69d19-1cf4-4ead-8fad-f425463056f8", "sighting--458fe9ab-9074-4439-8724-b0325590fd5f", "sighting--5fd52d8b-305d-4a97-979a-dfcb0a05005a", "sighting--2a47b932-a8af-4e89-8f23-4605265875c0", "sighting--e3042011-405b-4eb2-a16e-be2bb420b463", "sighting--e7f80fbb-a0a3-4469-ab1d-5a1210c491a9", "sighting--e7aa5504-5275-4810-b772-95fb143fd390", "sighting--502453e5-7fa6-4b98-a4e0-f05964612ece", "sighting--b7f826dd-93e6-4178-a4b4-b0ec4ac972db", "sighting--54588499-9f1e-4ad0-afde-c702b94e9770", "sighting--34da9d6c-99db-433a-84ce-f21b9510bccd", "sighting--0d95ed24-d0b3-46aa-a665-901a26ab0896", "sighting--1ba7e32d-a7be-49f4-ae52-4989fef8f0d3", "sighting--7d967d7f-7bfd-4a6b-8b25-bf76ba6eca09", "sighting--4eb7d663-b00f-4269-a2ed-96784df7de4c", "sighting--5b1cc69b-c100-4bce-9352-0d05997b4c07", "sighting--3f8553ef-15d2-4cfd-85df-7b4ea62337f6", "sighting--0850c2f6-f682-4c98-8699-b0e01e35a85d", "sighting--2a7b6972-f847-42b8-904a-84bfe824804c", "sighting--5a65b2c9-ec8b-4870-97a2-7353a7d7e562", "sighting--64af3efb-85ad-4d76-a18a-c9ca406b358f", "sighting--d74ade4c-81f4-4306-98ee-7fde1cc91dad", "sighting--a35120bd-45f2-4fa7-94ca-db4eb469ea91", "sighting--3f44cfb5-9fd6-4938-b0bd-f610bc16833b", "sighting--4a3a6f35-aa8d-4572-a0ad-a08b0d7bdd8f", "sighting--e1040723-6a73-414e-95e8-0d0fb3f8ef46", "sighting--270391f7-f1cd-45ed-8e09-26b62ad2b268", "sighting--32cffc15-2dc3-40f9-a737-307b0aa1487b", "sighting--0c042e33-2274-4f9e-a253-1d4701d4d7b6", "sighting--c42435f0-19c6-4577-af55-961c81681751", "sighting--0915b9ac-6240-4950-9174-fcbd40b828f3", "sighting--eeaababf-7a1f-452a-b8d2-b0f791000f76", "sighting--5b59e2e1-62d4-4ba6-97d9-6792ebb64e5b", "sighting--34b6bce1-8398-48b7-bea9-5c7b63db3fe3", "sighting--fe8bc89e-1021-4a0a-b4c4-d99c4984779f", "sighting--d8c8c9cd-01d4-4d62-b5ef-09c34322e3f6", "sighting--a75ade43-0c55-4a28-a312-d0272a3127bb", "sighting--922823c4-b090-4e44-a462-5b6a9bd784f3", "sighting--b3667e6f-2ad9-487b-bf12-78ab3e8bf3de", "sighting--092d868d-3c4a-437a-a671-df6097b76a7c", "sighting--bd1eb102-a9f9-4326-bd1f-7de3e27eb649", "sighting--ba32fd4b-732c-4ea6-9df4-b69023ddbdbe", "sighting--4e1fefb0-62da-4463-8932-9f597e974085", "sighting--1d417b9a-d5db-4b16-b730-bdda8b8e3e02", "sighting--7b704e29-b354-484a-85ac-178233c87892", "sighting--60c23f7b-ce9e-4b9b-be94-456716ba3cb7", "sighting--d57d01b5-2120-4a5f-a4f1-209d2802aa38", "sighting--754840c8-9bfe-491e-820a-e5aaf775c927", "sighting--34839924-a86a-438a-a21a-9015502ee9d2", "sighting--d74aeecf-0458-4164-9611-15dff56322de", "sighting--e8d2a0ef-cada-4cb4-b3e8-7f5ccd3c5557", "sighting--d615822a-af68-48d3-8bd0-10833692bc2d", "sighting--c7473881-0810-40fb-9907-b596e7d7865f", "sighting--7d058a3e-c7bc-4df1-bce4-287801c0234f", "sighting--26558377-20e5-4128-8304-66a1d1e7c402", "sighting--11754622-d4d8-49f6-8452-d665979633d2", "sighting--4e28ede1-9376-43f0-b154-650533b7d628", "sighting--948d9501-0050-42e0-87bb-fbd0009f52c0", "sighting--bbdab2e5-9eee-43b0-b799-50cbd2b047e7", "sighting--935752de-cab0-4288-93ff-54b6b7f1c463", "sighting--f7659050-0575-4eeb-8484-f09288ed31a2", "sighting--0e67130a-b775-406f-a1a7-823c8ff6e879", "sighting--d71f8335-4789-42da-8dbe-2a033da16c92", "sighting--06531a06-4ddd-4f64-b2b7-3bca0a3eef27", "sighting--e6ba91a8-2d8d-4665-b7ee-4a545847f372", "sighting--bfdbeee3-c808-416b-afc6-4b1661738e28", "sighting--2e00cd94-6dee-47a0-9847-5b9801fbc787", "sighting--6f534864-5c53-41b2-9642-f55395b28f84", "sighting--a2ca15fa-13a2-4bcc-bda2-0370ae825a22", "sighting--87cd91f0-c3ff-49a0-9a58-3885e268ff65", "sighting--b58f855b-7092-4478-9768-bf5852f5a0c6", "sighting--77776cf5-4269-49c2-9069-3d3bdb4f49b6", "sighting--d67444aa-1ba4-4726-9eab-b3b9e09bd962", "sighting--092e2bd8-91d6-477e-823e-b739690e268d", "sighting--dce35693-a1b9-419a-ae44-ee51dd567d76", "sighting--34e2bb90-3d46-464c-b270-c5ecead2c252", "sighting--18572dfc-168b-4abc-925d-a352df44d607", "sighting--814d369f-739e-4bdb-90a6-33435c6e1ba9", "sighting--b04ae947-4cd0-4768-9c61-a4ec3bbdcc60", "sighting--40c804ea-8d9d-4ef5-b6f4-38b815786a96", "sighting--ef564dcb-3de2-4fa4-90db-f278338935ba", "sighting--aedb7d51-0dff-4341-8bd1-8090176c52ef", "sighting--ca260773-eafa-468b-adf3-aa737722868b", "sighting--566674dd-6e1e-447a-817e-6b8f70a885b2", "sighting--1ee6a8d8-7462-4896-a49e-a1fdce8eb1ec", "sighting--93bd86e6-3d79-4193-86ce-809f9aee19a9", "sighting--878b5622-f915-4424-9d54-41d8fa343d16", "sighting--b0ebc8fe-02a7-41c4-a4e7-35a5bd263e60", "sighting--88d15009-f83c-4263-b452-ad9c9e46b9c2", "sighting--9110850d-3268-465d-b398-3f859f5b17f0", "sighting--8b564670-17cc-47c7-b34d-0af34565e470", "sighting--bf83e3ac-f9e0-454f-aca0-799dda11d1ca", "sighting--6aaf72ca-862a-4667-9016-ea639f74e3b4", "sighting--2b4c0a15-94c6-434c-8180-8b8816b6e66d", "sighting--15d0de65-6903-491d-b201-da35eedbc927", "sighting--452aba69-4763-4ecd-92b4-049ad8e9a381", "sighting--8065de9f-1085-4854-9f5b-a04cce4cb25d", "sighting--aef17391-e434-45c9-b93a-7995874bc20e", "sighting--c32e45af-aad0-49ec-bca4-664354c1e529", "sighting--b5f455ae-6388-4260-8253-4da39dc8170f", "sighting--b2d2bf25-4498-4d8f-aef8-a46fa08e8a36", "sighting--c42f3be0-e661-40c1-8312-388aad5c7afc", "sighting--beb13648-b770-4d36-8d77-3f23d9155ebf", "sighting--91287f98-2d93-4d60-9126-992a935dd474", "sighting--e404fe0a-d65e-4e29-9970-e9f6bfae9e1b", "sighting--ab948629-a3a2-4e13-beb6-d80eb1a4c165", "sighting--d7da9115-9aa1-4343-86c7-b0939089018c", "sighting--bfd67da2-800b-4fda-9f98-f21c6c0044dd", "sighting--3e88a089-c593-4c99-9f38-ffc32b4a454b", "sighting--729aef38-1631-4eb6-9677-7491dba2af57", "sighting--f6d0d8ba-221d-43dd-a973-650d10c5623e", "sighting--2cc36fa7-0663-4d0f-86c5-450e1ccb1bdf", "sighting--aacd0bf9-139c-4f8e-8130-1a5457bf4a1e", "sighting--036f8a5d-1d00-4a80-ab04-58a2d861d027", "sighting--4fe6fdaa-7a5c-41e5-adec-e4d7e8f291e4", "sighting--6fa61715-719f-41e7-9dc3-a07b8f783806", "sighting--a69b96e1-301d-47eb-abac-d3f78fa34652", "sighting--dc809bfa-6e24-4f86-a58c-0a764223b04d", "sighting--7e578cfe-80d9-461b-a0c0-c9295ea0e43c", "sighting--213688be-fa91-4498-935a-bb97a333f2b3", "sighting--7a41de5f-2e86-4499-93d7-9391815b61b0", "sighting--d7828af4-8353-4f52-99b3-67f6e655ab5f", "sighting--f29bcdcb-12a7-42ce-9b65-95f16c1750e5", "sighting--91767020-b4eb-46af-acc0-6de554020dff", "sighting--5be26aa3-0f81-4bb6-9793-24abd235be27", "sighting--f1ac3ce5-6c44-4045-a54c-1d3f06ab0c0e", "sighting--dfbe7963-032d-4356-90bf-a18fc8584c65", "sighting--44331642-fb7b-40e2-9ea2-bd706f10d15d", "sighting--c0bb0a6e-2b9c-4ef9-b9ca-34c7ee749e74", "sighting--1b98ff1d-1736-499c-9185-dc505a93729a", "sighting--20419742-64e9-4dd9-88f1-fde720b08bda", "sighting--82f23ff2-6046-4e0f-9782-87f97acfaefb", "sighting--b65fa0a3-70bd-409a-9387-e14e85e68e55", "sighting--10eddf33-7038-4ccd-9d9e-7f81bdfb61de", "sighting--08d3f87d-fe41-4589-bc3d-583277628cd3", "sighting--b467101d-a928-4d0f-9b94-0f5552b897d3", "sighting--62c738ad-fb5b-4f17-99e0-0dd44871e040", "sighting--239e0276-bc75-4516-aa93-3a2797fa9870", "sighting--8d6f52c5-be9e-45a4-bb5e-ed7c66791b2a", "sighting--8a9ed1ce-0086-477b-aa2a-405010ab721a", "sighting--688a2edb-e455-463c-b3eb-141095b58c09", "sighting--5c5a96cc-b694-47fa-bae2-475181569bd7", "sighting--dcbbd4f1-c558-4b48-bb34-72ab8df2c5f7", "sighting--032e0452-a235-4c1f-89ef-b9baddb633b6", "sighting--efa6bf7c-c3f1-4e2f-bab7-a5192572ac4c", "sighting--999de684-9fd7-4ab6-acdb-336f08c1cc13", "sighting--2ab2458b-a933-41fc-b046-79c99fa1f742", "sighting--ba9aae64-b094-4e87-ab3e-e02d8b505d96", "sighting--9f1b24ae-fe13-440a-bd07-944d9a0da7c0", "sighting--58de9e6f-0221-46a3-9a0f-831f12236e5f", "sighting--204a76ad-7e18-4df3-a157-be0c214fc261", "sighting--68188cd4-66dd-48d4-bf48-69300881bf6e", "sighting--f6d9ee6c-a2f6-4769-8855-55589e32d5df", "sighting--8a0f04ed-fd48-41ea-bfb0-832e1d8b620e", "sighting--649f146d-c146-442c-bc2e-3fbd9b207e25", "sighting--37342b02-c820-4f59-b91b-d9f70929a9a1", "sighting--cb55260a-2fe0-4356-b6f3-9a9ea0acad5f", "sighting--e9272d4a-675b-44eb-9feb-7da5098844c7", "sighting--1479a1cb-44c5-458e-830b-a23e639de416", "sighting--bfebbf1a-4f3c-4c3f-a906-21af5f8c704a", "sighting--7eb63ab8-2c4f-4727-8aa9-16fac102d831", "sighting--600d7919-5d15-4cf5-9cfb-0dca607175c8", "sighting--005a5f74-14ec-4081-be65-f47c363d720d", "sighting--1438ec68-09f3-4494-967f-1a2a16e1dc6e", "sighting--f93c2c85-771e-4eab-9e72-0171bbc0421e", "sighting--87c8ff22-c3fb-4632-ba21-6fbc6973d3c1", "sighting--f1e06766-1ecc-4a1a-aa0e-dc9da4f36503", "sighting--02b22480-44e7-4129-80a2-88a24638f5a1", "sighting--17079c71-caad-40fc-9bf0-459873c2b17b", "sighting--ec45eac1-c11c-4bad-be46-e11e255d4907", "sighting--fb1dc8b6-19bb-4331-8df0-f4d24f63ee7f", "sighting--db660de5-7b9f-4d85-938c-f8047498d8f6", "sighting--440fda9a-c574-4d56-88c1-451c14e251b7", "sighting--3dbeff4e-bafd-4e69-abe6-7f9b806f64f4", "sighting--3e576b35-ae53-46f9-9f22-a3930675c63e", "sighting--df5fb4ee-6c76-4004-b7f7-4277563c0849", "sighting--e945dd31-9faf-4f00-9a9e-a033eb379653", "sighting--4167b81e-0591-476b-a091-fc14c8b70468", "sighting--25a10319-8932-4ac3-94f3-5f6a0c4df2df", "sighting--ee407b06-a539-4161-a88c-5a5a3a645ed1", "sighting--712efcfb-bbb3-4733-93ed-228c15908bf7", "sighting--b8e63c96-73f0-4415-b118-b05dc7ee2e6f", "sighting--e972e647-ef9c-4632-8b60-f090c5f3674f", "sighting--a69e8f00-7a74-41da-a889-256d0b49e78d", "sighting--f83d1653-4f8a-4a5e-8034-6036f8e36038", "sighting--48d2c921-2ec4-44d3-868a-9340fd87e431", "sighting--751f77a7-2a7d-48eb-91ef-416d8c8afcd5", "sighting--14a5ae37-6a26-465a-a54f-f505e9b6407e", "sighting--430979a7-371c-4568-8731-8898bc17d18d", "sighting--d82103b1-750f-4762-80b7-910a610a0f2a", "sighting--2ea63bc3-040f-49bd-b2a4-dba8c2a1e93f", "sighting--a13bd07c-af4b-4480-bb41-1ec78b5d2969", "sighting--5fcbee90-98ba-47c5-b154-afe57c9400b0", "sighting--ae9231c1-dc21-4465-8282-ac8a92b6b533", "sighting--1a4523e2-5a7c-4a85-90b9-3fca7c4cabc5", "sighting--5704c560-c6f3-432c-b2c7-6d34ef997ce2", "sighting--f61f2ca6-b78a-4422-bfba-a9a6f290ca2d", "sighting--f7533d6c-6aa5-404a-b586-b9f35daac659", "sighting--76772d98-ef7e-4b6b-8bac-7f3cb9ece5a1", "sighting--cb777a4e-6946-4630-8d5a-913f1a18d07e", "sighting--912c66c9-074d-4d93-ad83-e72cbdacf3f8", "sighting--5e4c2b55-6b00-4077-8650-db83277d10d9", "sighting--e62532a7-42c4-4f6d-bf16-0421c1644ef3", "sighting--cc60e4ca-9363-4e9b-bd70-bc97b88dd902", "sighting--4a88865f-af75-4700-b6b8-717f55d6fddf", "sighting--da3133cd-9181-41ef-bb61-544674991c0d", "sighting--f9535abf-ba07-4284-a0a3-e1ae53ebf8b2", "sighting--d364be66-5262-487c-a30f-a201503673a2", "sighting--3ab38b59-0e8a-4ba6-8155-f62d21d806a3", "sighting--f0533e7a-9b45-4398-9e59-4492e5f4ee09", "sighting--368aebdb-a814-4a6d-87c0-dab48efbcb25", "sighting--5110d483-e532-4723-a66a-170ab33bd885", "sighting--6b67ffb6-c116-4b81-a9ea-483d3eb72cb9", "sighting--62cc18ce-27ae-4e0b-9839-e1f16db147cb", "sighting--53554eeb-b96a-416e-83fa-9d1ede2e2e8d", "sighting--5859c05d-1769-42ec-a0bc-369d80da6373", "sighting--24b2ffbd-b119-4e32-8dab-66324604a622", "sighting--5928f617-937b-4102-8a3b-1cc441164e29", "sighting--8b1450ef-9a6f-4381-941e-738dc3cd44d6", "sighting--734a0d90-7608-4489-988f-f022f11190ac", "sighting--d68a0619-8739-4d11-a4e5-de184769f6f5", "sighting--b06e31ef-f748-4529-b2cd-714c1a9163bb", "sighting--4d8a683f-06fc-4e88-8573-dabbbd6e5327", "sighting--045dca80-af5c-459d-bae8-f60e43f34310", "sighting--661412de-1e08-45b5-b02b-ada863d7faad", "sighting--a2f41626-a43f-46f0-9103-937b73585da2", "sighting--aa8b698b-c933-408a-90aa-c90e7d454b18", "sighting--f7de386d-df12-45cc-b131-016251e76696", "sighting--3dd49992-3fb8-4167-b055-ba1f0565e378", "sighting--7e55e390-0229-457d-ad7b-08dca8186025", "sighting--32076fdd-2caf-4286-ad3f-51badcf18086", "sighting--c74cb52c-05b9-4430-ab30-9a061f6db765", "sighting--7e04c8c2-57bf-42dd-927f-baa0cb2ed948", "sighting--9150d79a-981b-4ad4-931c-de51b54c5427", "sighting--f1767b1d-c5c7-4f9f-bcc2-c4825243b713", "sighting--53355eb9-70b8-4a78-8764-2a0bc7a0209f", "sighting--73dcde94-7aef-4daa-8a69-2b5ffd639bf4", "sighting--0089066c-7fb1-4826-a336-bfad18f99975", "sighting--b4283fac-b817-489c-9e4e-7326cff40de9", "sighting--becfc59b-5074-44d6-ab21-f317fb532467", "sighting--e1565214-2b6a-455e-8888-7616d22ad080", "sighting--20e131d6-9ac0-4da0-93b2-97fd0b63c1d6", "sighting--f0ed04d9-57b7-4ea0-863d-57bc2f16e817", "sighting--2a66e118-3b7c-45ca-819a-21e8b61a5035", "sighting--fc7e178d-aa12-44e4-9c15-57dca5936877", "sighting--3fb08fb2-0fa1-49ec-80c0-c1e5c4c8d5fe", "sighting--1a42dd38-3e39-48b1-b880-4fa13902e364", "sighting--4dea0014-b404-49ab-93c6-06eea78f9471", "sighting--fe38e0cc-4348-467c-8d6a-50156a86b4d5", "sighting--e92cdd9a-f4d3-45bf-981a-7d1033b95090", "sighting--83ab8663-b96f-4730-b620-179dc7c3dc57", "sighting--c5dfdbb2-8c60-451a-ba99-749e71b4fb74", "sighting--515aebf4-bc45-4399-ac72-b5a3d8197c72", "sighting--fde5a5ef-db05-4df0-a1ee-cb223c4bec4c", "sighting--7e6525f8-1ad4-4dac-a76a-666327da072a", "sighting--b4a565fd-e34c-488c-8a73-66df2e2838f8", "sighting--9df2b97c-688f-476a-8800-3c67a343fea7", "sighting--767ca65b-dcc6-48e4-bc9e-46196a9326ba", "sighting--6a7a17ec-1ace-4650-a15b-411de61c734d", "sighting--aa5f77b6-2545-4dc1-ae94-825adab02726", "sighting--d8929257-8646-48d8-b6cf-b40963ff1d8e", "sighting--e3350d38-29b4-4043-9a3b-85264511b661", "sighting--76b4ad6a-cd29-4f25-a6a5-6822bdc38f6e", "sighting--574528a8-d59e-4b5b-99f0-168c6a4e6346", "sighting--6e4dd77b-19d4-4e78-895c-7ee519b9f050", "sighting--bfd57fa6-7cd5-4031-b271-e317bc023412", "sighting--03a61662-8190-47e8-aa38-c7944e41951f", "sighting--69a6d3e1-e950-43e3-803c-eea73d0b3b5a", "sighting--f0dccf72-15e7-4d5c-acda-e81dba992c5a", "sighting--ced906cb-f36c-4f6e-bfe6-1ef8fec6fb8f", "sighting--fe2f5d27-804f-4949-a65d-c0f9b820084f", "sighting--49f999ff-bc6d-44b0-86e5-df5c688832c3", "sighting--66185abb-b025-46eb-a3a0-658bee6d1500", "sighting--b8d17a91-424a-4b50-965d-6bd823f3f831", "sighting--76ed5326-0db4-47aa-8804-ebfe9e646007", "sighting--5489b3af-ddbf-47a6-b923-c4401c13c5b7", "sighting--64d49ab2-cdac-4614-a80b-77a40e5164a1", "sighting--b1be1d84-548d-4a38-8349-55d205f629a5", "sighting--efdb0407-b298-4894-a7c3-fe2e1ab6795f", "sighting--afee510e-44cc-4f9e-b2e5-0d5a4b2162e0", "sighting--631d7cd6-915c-4c48-bea6-f7835a727787", "sighting--30c42ee4-a0e5-4019-b29f-16d479552343", "sighting--2fdd23ba-9a9f-4db9-a9fb-75c2ead922dd", "sighting--8938a51f-9146-41e2-b587-517cbcf1e6d6", "sighting--6d18c892-5bbd-4237-a069-8786199647ff", "sighting--013fa405-66b4-4507-91b9-002d47801539", "sighting--3df326e6-3348-4ee9-bc50-f0722aaf2ac0", "sighting--47ed5bf1-f327-44d6-b7e9-538b230eabd2", "sighting--6720235d-5255-436c-8a59-622f2599dab4", "sighting--50c8c333-ffd8-4ffb-a169-946062de829c", "sighting--603c10e3-bdd8-4be5-8c71-8a357ea1feaf", "sighting--ec8e720a-5f76-4605-a0f9-5e1f4676ef28", "sighting--dcfd3751-7768-42f5-8872-eda0d26fd5de", "sighting--e0e3f92f-a6a9-4923-ad63-8fcd78ae5ab8", "sighting--b92121f8-58bd-45c1-a8ca-8eee2788f63e", "sighting--28512109-2337-481f-ba5a-09205894f0d4", "sighting--0cbeb8fd-2b58-43d5-ba71-d005979960b8", "sighting--4b87ba14-4d9c-4948-87cb-f69e9955833c", "sighting--28c63907-050b-4684-b1b4-c137a4d01f48", "sighting--d27edea4-c78f-4114-b1b2-fd18e9a07b70", "sighting--201f1792-2d64-48ba-a1a5-f09881e370d4", "sighting--9d31acb4-c4cf-448f-9284-5dd351f44f4f", "sighting--d010deca-0d83-468a-9924-59964c8a82a6", "sighting--b352e993-9fae-434a-a025-71174402f2d9", "sighting--44d4e0dc-b54d-4171-af73-89b0a029d572", "sighting--ae8f92d3-7855-40e0-a5cc-3d2086ca02ab", "sighting--a3899bcb-c945-446a-953b-ad4bac8bcd95", "sighting--e1150515-6cee-4f00-82fa-435f991dede9", "sighting--b410e8a6-4c3a-43e2-ba74-4449b2b1eeff", "sighting--dc1a8f57-aca5-49b9-904e-bb5e00a925a2", "sighting--91c3146d-9213-408a-bd09-2a077c28e575", "sighting--714cbd06-1503-49e8-a0cf-a74a92a026ad", "sighting--c540704b-d85e-4298-a119-5b26e842bee5", "sighting--62082998-fcc9-4666-b7c8-0c145b10e226", "sighting--57be57b3-6057-40aa-8b7d-81cf5a8c65e6", "sighting--f526c735-5d6e-424e-8283-69889f3a5d56", "sighting--eaf3ebaf-5e4f-4f0b-8b3c-9186212faecb", "sighting--5b338140-0bb8-4f0a-9c38-89d10a22df17", "sighting--2dc2284e-3abe-4c4d-a8fe-8a0277faaaf5", "sighting--9fc769b0-33a8-413a-bcd6-021e395a4db1", "sighting--5939e048-af15-4619-8289-1149cb795e5a", "sighting--ca62d859-3659-4e3b-9d76-71d6577591ef", "sighting--06563a5a-db4c-4654-97a5-d9e9fbfd0b28", "sighting--c7319bd9-dc8b-49c1-85f9-65b4aec276fb", "sighting--3037279f-de1f-45f8-a408-110429730b72", "sighting--eea9802b-2637-4bea-9acb-df3f232aec66", "sighting--21cc8f14-a7b1-4628-87dc-faf80dfab0c8", "sighting--24a2df3c-6aa2-47b4-aeea-ab16beff203f", "sighting--ca926a75-77e2-47b2-b29a-2014a95eb87b", "sighting--d0534380-8922-4153-8df3-74a6fa05651c", "sighting--3e910cbf-1435-4935-80bc-cf6d79e81f4f", "sighting--d11cd226-2439-41f7-ba8b-b1bb637a77e9", "sighting--53726f9a-6ae4-4465-b80c-daa741c70ab0", "sighting--95e6175f-cc2f-499b-bd83-8db07b890ba7", "sighting--89369410-128d-4c88-8561-c5b69e359ddf", "sighting--01f12b40-d716-4026-9f24-a552e0bc564f", "sighting--722776dd-6426-41bb-aed0-d4834a02c24f", "sighting--bb7e983c-927a-4cab-8810-596ed05a9943", "sighting--782d6183-25bb-492a-94a7-f5f74b983b5b", "sighting--a7aded74-948d-477c-b349-db9e58d5f0f9", "sighting--3bcb3aa7-36d4-4ec4-b2b9-4f26260d1f57", "sighting--b5c45d0f-7ee0-434e-ab3b-57f538f3aa47", "sighting--23bd0358-57e3-43cb-a6a2-76f2a4c49af8", "sighting--a7073648-48af-4b84-915f-fb29adbfde1e", "sighting--e1b56ea4-a9d1-42f6-b49b-173d8db60312", "sighting--c44e0519-e866-4bf9-bfd1-02f8a05ade3b", "sighting--509a2ab8-e2b6-4468-be7c-e2f160d94200", "sighting--bbe72cd6-b9ec-448b-bac1-055ab59687a1", "sighting--528ca59c-0bf5-4dfe-bf41-922e9748db9d", "sighting--033d92bf-2a69-4dae-9b18-666536344b6f", "sighting--bcd0ca36-0372-4c8b-9379-8ceb8838ae3e", "sighting--ff121d9f-7f7f-4fd7-b2eb-e1ea783872c0", "sighting--e979cf33-e771-450e-a9dd-7f6a6b22e1c4", "sighting--3a14525e-079a-40e8-a3fe-e42df5015405", "sighting--60ed3181-5891-4f5c-ac59-c366a4a3f9e3", "sighting--c8d31de7-baa3-4d95-83b2-99f7830e9638", "sighting--b66620e5-61ff-4d49-bfa9-c242273ecc02", "sighting--c7da6e4b-1f6e-45be-96b2-421c991c35ac", "sighting--c1ccfaff-1cb7-4996-89c9-1cfb9ccfafa7", "sighting--3bc9100d-5ac4-4116-b094-334f4866eb1e", "sighting--104faf30-3e0c-4619-b0f8-522569b6a838", "sighting--5b55aa12-1077-4cd3-a016-d38369115b59", "sighting--83236a9e-7c1e-4d8e-a38f-60a05042ed72", "sighting--e1dbfd53-fc14-4255-88e7-3517105a2ac1", "sighting--a9870258-616d-49ea-aca2-1ecfe1983fb3", "sighting--6c85d64d-771b-40d7-a817-7ffb360ef1ec", "sighting--ff3383ab-e82e-492f-a4eb-b2405575809f", "sighting--a8fdf59b-c063-4038-ad11-7f46a106e44c", "sighting--d9e6b93e-98ae-4ad9-b364-683537594cc3", "sighting--1fa82ee9-beeb-4963-9bb1-3e7281c9040b", "sighting--508d539a-c8bb-4231-8083-23d99e8fa30f", "sighting--75bdea4a-4db7-4fd4-82d9-d0e8c06460e7", "sighting--994490a9-f040-45d3-8ccb-93168ed5a3be", "sighting--d8367892-cd06-410b-8213-5c89829d8b97", "sighting--bcfce22c-82b1-47af-af96-e9fc8308a22b", "sighting--20ae3884-ebfd-4447-abda-c4785736b3ec", "sighting--307f910a-6b7a-4bfd-9db7-13fdb69c5134", "sighting--86fcb4b4-6cb0-4d70-a6e4-0380e3e6abf4", "sighting--ab28b2bd-ebff-4e78-82a8-159756b3b7f8", "sighting--dbc8b5b0-8495-40d6-bfb4-002cd18fc69b", "sighting--3881e055-9139-46ca-ba7e-ad465b43c1b6", "sighting--6015d512-1afa-4bbe-bb47-2366eb236d16", "sighting--578cf49c-6cb3-40c4-a18e-294a93dc8013", "sighting--1d9fcdca-d6f8-49b0-a91f-353cba979c47", "sighting--f1fdbee9-e612-48a8-ba28-6e386e16dbff", "sighting--11637669-cdc9-4c5e-b81d-13d017f0514e", "sighting--04b931af-e6e7-4a5b-8a77-0cb6ba3c56d9", "sighting--07ef4b0f-0a65-435b-af9b-cbd90937ae3c", "sighting--af1d45d9-9e8b-4c12-ad89-db1d180c7659", "sighting--81e4fa01-6b28-4afa-8a28-68d9f814f7e4", "sighting--2c797f3a-122d-4fb0-9878-42444cd06f06", "sighting--c8544a2b-53ac-4fe3-9f4b-8bc25efc7801", "sighting--6f19b1ed-059a-426b-a31e-d303ecff5179", "sighting--d9f7d90f-8a30-476b-92e2-3b599e546889", "sighting--91851ffa-9634-4cf0-9357-c656c1188dfc", "sighting--2200f0e2-f131-4b3b-b6d6-3279fb2f3580", "sighting--c5c7bf05-fd31-47a2-a31e-4cd5556d70b8", "sighting--46894021-6af8-4ec6-a9b8-99d9d788cf7d", "sighting--687647b8-a490-46b7-83f4-e2322bbc52b5", "sighting--65ad33e0-7d1c-4896-a1b5-8e5fed5838b7", "sighting--03a235b0-9133-404d-8a92-deedcdadc39e", "sighting--f91de388-18ae-481f-abf6-5d2e1c279d88", "sighting--87c1d9cb-4bb0-44c2-9162-5d8d4336718d", "sighting--676cfa4c-5da7-4cf3-a594-1cd27fe07f04", "sighting--d6808644-0e27-4ac8-bea5-5f48c538c22f", "sighting--dc8e8849-d4e8-479a-acb6-29474b5fd372", "sighting--69816b2a-e56e-44db-89f0-d917b63bd451", "sighting--2fc1ba4c-88a7-42e4-9eb2-67bd2876a00a", "sighting--75d0d5f5-d468-4c1a-98c4-7c8128372671", "sighting--955cd344-e2e4-4805-9c35-8d2d65d7b2ba", "sighting--24c8fcf5-ac84-424e-8847-a1e97e5bce62", "sighting--f776dff0-8551-4262-8685-2481297dc550", "sighting--3062aa8c-c277-4af6-b0db-5cb53bfe6c8e", "sighting--628fb635-8726-4525-8ee5-efedf0901bb6", "sighting--755a97ca-5a92-4285-ae32-96f73d3c2f15", "sighting--28d91f81-eee6-4019-880c-cf9d8aabcfaa", "sighting--9959e05c-2f60-4b4e-a329-c51031f84e0e", "sighting--b45b76c3-6d02-46b8-9ee8-6dd61b5d6aa4", "sighting--674a740f-451e-4f8b-bd15-091c96860ba7", "sighting--acb52a0b-827f-456b-96e6-b3a4c8329624", "sighting--bbb3e94f-ae6b-4101-9eba-3d4146e650cb", "sighting--758961b6-6593-4f76-b00e-c209c04cb020", "sighting--fff7675a-7db0-4a4d-961a-792e6ba54956", "sighting--9dfa087f-d166-46a3-b80c-ed587d01d8ab", "sighting--beebfbb5-1f46-41d8-b242-6e07bf5d1d15", "sighting--979fb03b-18fb-4077-9512-999960df4e81", "sighting--d2bf948e-6b09-4458-b5a1-d8a28d19c364", "sighting--f92b1afe-17eb-4cdc-b251-555bdf083c0e", "sighting--0676faf9-6b81-43fe-af7a-138b9892cf60", "sighting--6ebf8950-a0e7-4ae9-bb29-e08127a7c057", "sighting--a2c4f086-6416-465f-a343-d251cad72d5b", "sighting--69e70752-b82b-4bef-83e4-1202472c4ca4", "sighting--a28946d5-d828-4b80-8d75-0e92f821021c", "sighting--15593f5b-a927-4dcc-858a-38b8df0613a8", "sighting--d3bef184-3a1e-4c0a-9ad8-d60ece078189", "sighting--e773a280-9c32-4034-a839-55c29676ec0a", "sighting--24238649-f0cf-446a-a4dd-f19ad82601d7", "sighting--6b74ebda-51cc-47b7-b318-ecd316e0f1b6", "sighting--f8d0d11f-afbb-4972-bb93-a43658fee58f", "sighting--17d24810-5d78-4f47-9d07-a495857ef093", "sighting--0447b05c-a983-4d0e-b5e0-1e2e6d67a765", "sighting--55eb7d65-2465-4947-84a2-81ec5e169664", "sighting--8088ec5c-e2f9-4ca8-a028-9757b34fbb66", "sighting--64de4a74-a247-4ba9-a455-284376866bd1", "sighting--3a2ac99b-1693-426d-8efb-15dde2baaf0f", "sighting--29624dd0-9396-4ff2-b050-a565556319c6", "sighting--c28766a7-5870-4f4e-a9e2-ce1cbbd97a4a", "sighting--ea894b22-d793-4ed0-a558-3fcef0a74beb", "sighting--73c8cf34-3ef7-4ed6-89c7-80be7f60d78d", "sighting--4d96f8d7-f27d-4f4b-b006-7ea82fca77cc", "sighting--fd0f2da2-089e-4866-8b43-1ae01985bdfb", "sighting--d7817fe8-195a-4291-a800-cfc8f06ac83b", "sighting--eb5e5b1d-ea17-44cf-82db-0488018c9e10", "sighting--5e5649bf-31e3-4fb3-82d4-233d9d016417", "sighting--5db5f40a-4a31-4156-a7e6-f0ff39819127", "sighting--b631f0d1-b8a2-475f-baf4-3ef4ba42c810", "sighting--3ff26e93-576f-4312-bc4e-f08b1b6d9c15", "sighting--456c219b-8ae5-4843-936b-6e8c93fd327d", "sighting--ef33df12-ef24-472c-8e3d-bebbde7508f1", "sighting--166cb390-1352-41bb-a4ca-f7a287f75626", "sighting--117bbd42-771f-45fa-9025-22510994a629", "sighting--b23ecc1c-bf67-4e5f-94f1-c618f767bb54", "sighting--23cfa0be-f5ac-4734-b3b4-0f0125572386", "sighting--7a8386dd-f25b-4b32-be1c-2cdbd86bcf9c", "sighting--a64f0245-554c-4ac7-bc11-b4a05c258138", "sighting--95ee9e23-120a-4c6a-a842-33eab14c5356", "sighting--62358286-fdd7-409f-902f-bc0654c6625d", "sighting--4e453a90-e09b-4cf2-8221-6226082ae5a7", "sighting--201fe6c8-0ee5-4e10-aeab-a7782abc5227", "sighting--f2309be9-e34f-4bf2-aa78-e3b34c85484e", "sighting--bd275ff5-e93d-4068-aa26-b9ec1abfb5c0", "sighting--d2956dbc-d8a2-40ba-b91d-0a032338a656", "sighting--61a9e5e6-8096-40e2-99dd-4d9c059dbc58", "sighting--11d4d7bf-9fbe-4478-afba-751393e70fe5", "sighting--dd4312e1-123f-4bf6-b13b-098d06addc54", "sighting--5c140e85-5da6-45a5-b686-4b346402bf23", "sighting--dffbe2d8-06ef-43f7-8450-287791498a72", "sighting--bd9dede8-ef70-4874-8d98-08b87a98338d", "sighting--7517751e-22d9-40ef-b410-e2028c564695", "sighting--5ed99451-6ec7-4fda-b6ef-3b358fcabaf2", "sighting--b3fa841b-3191-4a79-820b-1aa893291200", "sighting--0cb8acb7-ae35-4af1-b486-defcdbdf3df6", "sighting--88a5a70f-b42e-4d09-a496-0a3539c8cbb5", "sighting--e626391c-4fc6-4fbf-884e-9916971a830a", "sighting--85d9dd56-483d-4ca1-ae55-89e5f23ca6b5", "sighting--70aa43e9-7b43-4da6-b525-5110dcf89fb2", "sighting--20a4ad5a-bef8-4b8d-8476-55832a17f59f", "sighting--d94022b7-0da6-41c0-92e8-1013b06df2b4", "sighting--8314ae19-4cb0-4ea7-8112-13dd3c05880d", "sighting--50818fbf-8c2c-43eb-95ea-ad547167c408", "sighting--2490e038-e442-4f79-8365-0eb3f8c41bc0", "sighting--3ecb26ad-52ad-401d-b3c6-c31a99529067", "sighting--1cecb2a3-486b-42f4-ac5e-62a163dfae01", "sighting--66960b1f-aa92-40ac-a7d8-1a5170d1078f", "sighting--6a63f141-ed48-4f5e-8c70-9ddfdfefa86f", "sighting--b18ff840-adf5-4d42-8522-7bf191c471ef", "sighting--36479cec-17e0-4707-925e-aa114487a93f", "sighting--22fede45-bd81-41f0-8cd4-8e712531572d", "sighting--854573d9-e09e-471e-ade2-d343a09fc838", "sighting--a5578719-8296-462e-a6ec-8d78f977b70c", "sighting--d97cf6a2-6cd0-4c7c-af68-5a7641f9017b", "sighting--5662c9d5-d1a4-48d3-aeaf-bc7389e5e014", "sighting--293d9118-05d4-4b74-a2b8-ebf6db6b210c", "sighting--6dc8b7e7-8633-4387-afa3-47e0ce37ce14", "sighting--ad6e18ab-481c-4829-88dd-b96936f9629e", "sighting--e9099a83-3e2d-428e-b70e-b2e02e825912", "sighting--479b16de-bed6-4edd-8767-48427f5d3b0c", "sighting--5127f41c-0190-4a86-b51f-96dd4c4c3dcc", "sighting--63771838-746f-4d2e-abb6-2399bc706c2e", "sighting--16d3bcfd-fceb-475f-97ac-857b522ad3f2", "sighting--78e09ebb-f667-474c-839d-6b1b049587da", "sighting--f3a1153f-36da-4c62-953f-65cbf3676892", "sighting--a818058b-7feb-4381-8f19-c2ea56d6174c", "sighting--01d0c807-5a9f-4109-98d0-99e5c045eaaa", "sighting--f527422e-8e20-4c8c-9367-94f83a3d6a24", "sighting--70974503-aa4a-42ae-a53f-1ff58a5df2ff", "sighting--9d5aa306-c8ca-49df-8c36-8b3c91f17c37", "sighting--a3edca72-a232-447b-9ff9-76e357dee2c7", "sighting--4e303289-e8c3-443b-99c1-976810978327", "sighting--a6012611-66fb-4e0d-a214-e5e2418c9f13", "sighting--384a2102-91b6-458d-b7ba-be479a547dfc", "sighting--00c4332d-85c7-4e1a-a88e-70facbdaaf66", "sighting--ce27880f-898f-4a35-8f88-c02929e9c03d", "sighting--86c135c6-937a-46e7-a669-88715fb5de73", "sighting--8a844a7a-3b61-4358-8794-d89cb7b0a627", "sighting--47e863f0-6c5d-429b-a54f-413e126f00a5", "sighting--1c8b8e14-58a6-4ad8-9834-eb255506d350", "sighting--fc4c38b3-7a07-4ddd-898a-e151b9687b99", "sighting--377449b4-2739-4a30-b897-2c140d589789", "sighting--ccbf2fe2-49cc-4110-9f28-7a207f54ac20", "sighting--2de38117-ae81-4762-8b3c-1525f01a30ab", "sighting--3e034ad9-0d7f-458c-8f3f-4cd8be1081e7", "sighting--b1d3b0a9-67e0-4c76-96f9-e2249d3baf3c", "sighting--a7c69e38-f50d-4b43-9b5e-f269451894ea", "sighting--66c41f5e-85d1-4017-be88-1ed85a3e0c9c", "sighting--6c6ff387-a834-4edf-9f17-76b5f2b49f2a", "sighting--51bc84fe-3c1f-406f-accd-9aed43a3e46b", "sighting--d2caf06f-01da-4ad0-bfde-64310f04cccf", "sighting--652ed85a-8875-4e83-b258-a75092d49507", "sighting--74d78449-28cd-41b5-838e-4c804fd468ee", "sighting--5422e204-d3b9-43c5-8af9-0f7d17b701a2", "sighting--121ae293-1bcc-473f-a979-5b83f410c4cf", "sighting--96a49d7c-1a97-41fc-8b17-4822522df58e", "sighting--fdc90a65-81dd-40a3-9865-8b264284f4af", "sighting--0a43877a-78ed-4f98-ba16-a301387fc748", "sighting--06f6080a-cbbd-496a-888e-3064af8b20cd", "sighting--b501b2ec-9e64-478c-ba32-0d458f13b67a", "sighting--9b2be006-1831-4e22-932e-d84466b03154", "sighting--3c9d7205-93b2-4111-9745-8ac85e030522", "sighting--53a45689-5486-4478-a864-d9389965f3f4", "sighting--1e985863-8e65-4020-bcc4-6c4e97998a7f", "sighting--a464a778-d65d-4e70-987c-88deb0100cc5", "sighting--67432cd1-2815-4b48-8695-3afabb624422", "sighting--4c5a4e3d-66fe-42df-83f4-971085af4544", "sighting--9fee7675-6718-4743-8690-ae03969db84c", "sighting--5d632704-0372-4316-ba6e-852120e60276", "sighting--59d8fd08-d43b-4527-9a03-09885372ee3d", "sighting--8c4c7e1b-899a-49ed-a7a3-b9af2bae3661", "sighting--954968ec-0bf0-41be-99bf-647d29309009", "sighting--79fc3c3b-1b4b-4744-bbe0-7e16a238a988", "sighting--e590d83b-6f83-4c6c-9b19-9a3caa0a7b93", "sighting--cf3b7589-a41e-44cb-9faa-3f2efc96f686", "sighting--66c41e56-b863-4055-9be1-c27667d7659f", "sighting--edf92575-e105-48f1-ac55-04a78b6cb8e4", "sighting--4f94cd72-388b-4a4a-bea6-2c4de6f6dc26", "sighting--bb5d8dfd-f053-45e2-958b-f644f351b4cd", "sighting--f6cf5e99-0640-4dcf-86da-2da9c90d9df3", "sighting--c756bfa8-a034-4853-ae2a-45d8eb1cde15", "sighting--f237aada-c358-4774-b93d-3f405ba4a27a", "sighting--dd1c8199-8bb6-4949-bfaf-a8f63c7a58f2", "sighting--a4e4dabb-69bc-452d-b5b2-92b352f40149", "sighting--98ab7eea-6314-4ed5-83c2-749409df8c30", "sighting--5a41480d-3b33-4005-bd69-ab22f37812e3", "sighting--cb29342c-c41b-44bf-b6e9-4d043d4341d5", "sighting--e8f105ce-75f9-4030-9718-704e1cece712", "sighting--44f71681-f5bd-411c-9641-25db98eac1f3", "sighting--a6f1b225-cf2d-44d7-a64d-208f5d0618a3", "sighting--954fc90e-3cdb-446a-bbbd-94c323a0d470", "sighting--fd254ceb-d966-4096-96f1-dc48e2c8d6e8", "sighting--2b2816db-2f00-4014-8331-9ad70b17f745", "sighting--0056f8a1-45de-4ce6-91ff-57bf85ce6eb1", "sighting--73f83611-7fff-4871-8ffc-7cdfb8357ed4", "sighting--946d2daf-9578-4cc4-bbc0-40e70793fd2b", "sighting--c20f169a-12a8-49ca-bff9-ce1eda559e42", "sighting--7d1cabdd-2c06-4bf9-99cd-979b82c4f3b0", "sighting--4736137a-56ad-41bc-ba05-771935273ab3", "sighting--b93a9087-8955-4fa7-953a-a16dd62f2cd7", "sighting--a3adfae4-0183-49bc-a429-06d435008f0b", "sighting--b9b007d0-a6fb-46cc-9bfa-e9ecf75b31d6", "sighting--4f0003c1-2066-40bc-b156-a1d0d4d0ddd0", "sighting--3e27a3ec-cab0-483e-8d8c-6c0ee8e8891f", "sighting--c173c88c-1c28-4284-9b56-b5c7109f932b", "sighting--8b9c7505-ff95-4873-aa93-3e36af5bd380", "sighting--9ada864b-f831-4d96-b01d-22ca0c83c4c7", "sighting--31b3e2dc-12e9-40a7-96ae-a96f98a07221", "sighting--6578124d-ec31-4e14-99ae-fa1e25d1088d", "sighting--fdfd3f25-0e44-4b76-baad-365becc9fbc0", "sighting--4c8f87c7-d6b0-4da2-a68a-041080e21f55", "sighting--71fdf44c-6b8e-42db-969d-cd149d0fa662", "sighting--ecead62e-adfd-4df7-bf26-85de5ead4cd1", "sighting--ee6e6f6a-9885-48e7-9838-16414d81ff3e", "sighting--db4be693-ce75-4acd-a3dc-ff05c32b2323", "sighting--c6644b64-3ba5-4615-9059-851447f439a4", "sighting--6206446c-72ff-4d62-a1d8-96eae2bf812e", "sighting--1006c6c6-3ade-4f96-8f2f-95afec6b5868", "sighting--526d2fab-bc37-48b0-88f4-ab916e298f11", "sighting--0e5624fd-f760-40d2-89b6-7c721c4f80da", "sighting--cdd81ad0-55c0-4690-89ae-07d0f22acbbc", "sighting--2707641d-f118-4a43-911e-5c48fd0f5dcf", "sighting--c2baa576-b0c3-4630-baf9-8737c1cf736f", "sighting--a03d7551-bccd-457d-b4fb-8f47a0865c4e", "sighting--cabeffd2-545b-4f66-a987-74b744508573", "sighting--70ffdc2b-edaa-4752-a05d-de5f9a6e4129", "sighting--41fd2c5e-97a5-47b2-849e-7ffdc38794b7", "sighting--c6daa16e-dc7e-4849-bd9a-080d9e9582e2", "sighting--8d7179aa-96cb-47da-a359-dda8d13ab247", "sighting--d036c3c2-7100-4535-b340-425887949881", "sighting--64177320-0ee8-4ccb-9507-b0b95b36e4cc", "sighting--efb7c1e1-754f-4c32-8805-053138ebfe1d", "sighting--47958e52-8472-4503-9f49-415b604677e7", "sighting--1792fa25-64dd-4b9c-94f9-145f20055069", "sighting--39fe976c-8091-4fec-a559-a5eae047be75", "sighting--0936eec4-be3f-48a3-bc0f-e8258faf07b3", "sighting--56fa930b-675d-4182-bb5b-2aff52fda908", "sighting--5547cd94-d045-49da-af84-783d6419cac4", "sighting--88457bca-b8ef-4747-848b-6d6cc25125a1", "sighting--d37c2d0d-b227-4b9b-83d1-a362ec1115c6", "sighting--ccdf15c8-805b-4837-ab99-c0627da9aec3", "sighting--da3a3466-a42e-4b24-9045-f7496c704805", "sighting--a505efd0-6205-4ffc-a16b-f5ce774a5b59", "sighting--0e52feb3-3d16-496b-8afb-cf3f84581102", "sighting--e6df6df9-3738-4994-b70a-66145f6e8d59", "sighting--6e0fb17f-6ffc-4aee-bff0-aee75b9a3751", "sighting--a6eb77a0-d412-4962-bc80-c6c89cbd291e", "sighting--bf122986-bdc5-4951-a794-12be2c39a1bf", "sighting--1fd222a4-1e4d-4190-bf85-ea1cedf35ecc", "sighting--4aaa7a49-f884-416f-a553-cca52e5c8a73", "sighting--92484fdd-74db-45a5-bd22-727d1b0f0e3b", "sighting--9c2ea503-236f-4d1f-806f-65bcaa1e1633", "sighting--da432bc2-d690-47e8-ac42-f903ec85d2ea", "sighting--736a3ad4-777a-4080-a2bd-53ac31ee919b", "sighting--f3794253-ad6b-46f8-8e63-a723daa4a378", "sighting--828baeab-3d87-426e-85ec-de78c6de6007", "sighting--82356e8c-ff89-4f01-a7e6-ca92dfeb2875", "sighting--310a12bd-04f5-4728-b349-3f6589d9a4f3", "sighting--3ba9f09f-7949-4c36-854a-d2d0000ffbc8", "sighting--825a3b8f-5fb2-402a-9b6f-715e2571abb4", "sighting--3084d03f-16a5-4ad6-abdd-b9629130f131", "sighting--15b9b555-1ef5-41e2-8a63-93720a89d4b8", "sighting--1b95435c-69a1-4122-bb45-808f33aee677", "sighting--fe4de4b8-4c4e-4f13-97c2-703f7abfc88e", "sighting--d8920568-d1bb-4286-8429-358c0bb749f5", "sighting--c265ea72-70c8-4a2f-a7b9-4397d23d66b8", "sighting--1189c437-f113-462b-bd55-412f895d9eae", "sighting--641ea9a9-546b-4c4f-a3eb-1d3e7f523b59", "sighting--cb3d5aee-0a8e-4fcf-a6cc-6ffc17dfa05f", "sighting--4ac889eb-ca29-4c95-8e9c-ef4fbc71b852", "sighting--f1a8ee47-399f-4f4b-9550-510bcf567727", "sighting--6797929c-2c15-4803-885a-afb9dba73104", "sighting--f7b11270-3941-4ab8-abc6-3a9e8283a133", "sighting--22e57d72-84a5-48f6-88ea-0711ed74d586", "sighting--4a3bbd53-db83-4586-92e2-c28a27720fc4", "sighting--62bb492f-fb5f-44a3-85f2-665c438996b0", "sighting--ddf7d0bd-a62b-48fe-b8bd-53c3530c6c64", "sighting--2a6de8f2-4c82-495d-ac8e-ba6ab602466a", "sighting--9368ecd3-0eea-4976-aa82-8fbcf3aff08d", "sighting--1221fa03-f7e3-4a77-b2c3-03bc29e77fd4", "sighting--9a328504-98af-4e20-a540-5fb46a099a6d", "sighting--e9ee8f5d-4ddd-4b92-9e7b-49d2dbe4e4d7", "sighting--6767cddc-c1e4-4281-97f5-55cef8f1f0cc", "sighting--33da035c-6b7e-425f-b2b6-8a56f1bdc08c", "sighting--8a3b55b1-55fe-4394-b9ee-bd974bec3843", "sighting--2a5ace41-bd2b-41f8-91cf-65b4472173c2", "sighting--4e45b897-ded9-4d20-b8c9-2747f4224e13", "sighting--d47923bd-e669-48c3-a124-745b6e6eb721", "sighting--891f2382-2e69-4afe-b93f-0f79f86cee14", "sighting--52117534-95ad-4639-ad13-aa0671408a1f", "sighting--dcdaf50c-4897-49d8-8da0-b36a71781a63", "sighting--372c9094-f7b1-404e-8adb-7b8317556e54", "sighting--953a3ba5-f715-414a-b855-7f5a285ce663", "sighting--bf521b2c-54e2-428d-b52f-2bafca37843a", "sighting--ff136fbf-2039-447f-8c3d-aa399997fb4f", "sighting--9d1b9b29-e20f-49b9-88ff-d8b9c8e4629e", "sighting--1843f22a-5c9c-4779-9cc1-efb0b81312b6", "sighting--2a5baf38-2585-49a6-808b-82ee4daf39dd", "sighting--7e0120c3-610a-4af3-a83a-2b9b7b07f1d1", "sighting--61f59ea9-b3ae-49fd-8bea-5b1fb36a48a2", "sighting--fe38f234-8ea4-4232-a71d-12d387503479", "sighting--267f16eb-d225-45d8-84c5-6101fb691ffe", "sighting--9796a33c-80ef-49c7-8943-a616edfe081d", "sighting--8a2c17a4-fe92-4870-bfb6-b18218ad9ec2", "sighting--679d3305-8db1-4129-8e3e-a19a3ff78e7c", "sighting--584878a4-8664-449a-9569-1b59fc5aa1fd", "sighting--6775456c-9b75-48f2-9414-1063c1b39e89", "sighting--1580326a-fc37-4fe8-9645-6d66bf766bfa", "sighting--bda8c839-63ee-45de-bb72-5a6ff81e0de8", "sighting--bac8353b-4ed2-4f89-af26-28978b52a4a6", "sighting--081f8241-b244-42a7-9019-e4925d319ed2", "sighting--337ff670-3d0b-494d-a818-c859dd75d01a", "sighting--c10284b3-5eb2-4448-9ad2-920bff86529d", "sighting--8ad354b6-7cc6-4a65-8e8b-8cb6aa1d2324", "sighting--cebbad30-e126-4ea6-b4be-99bb3d28f9f0", "sighting--b89d9c5b-4edf-4594-996b-3995837d3b14", "sighting--551a84f2-6939-414e-a436-b4de2f78fe47", "sighting--8998c626-22d3-44ea-be1a-e0f62cd7eac5", "sighting--8b9e8060-810e-42cf-9ba7-c76ba72d1a45", "sighting--f675afac-d569-4f70-a8a2-25cf3dd41eff", "sighting--91758038-232a-4266-9a0b-d72c3937c004", "sighting--264e7823-786e-4d9e-b362-dbb69f4fb8da", "sighting--e69ae994-425e-4cd0-8fcc-e49b14b56ccc", "sighting--6f2b238e-0a6e-4a60-a153-27d2ef6cbd4f", "sighting--6c53cbc4-0175-4b75-b3a3-8829b53d1b16", "sighting--c1865750-4d4a-4128-9b25-fcf1507b47c5", "sighting--31686f9c-ebba-4abb-bee4-a4ac662fae94", "sighting--7ad64e24-56ac-4f69-aa75-613c7985dd35", "sighting--a67fcdea-05cd-4baa-aeff-932b28d612be", "sighting--53981dee-5390-44e3-b12a-20608b68a0e1", "sighting--86756bb8-1eb2-4b0a-9650-e07a07975f92", "sighting--c4ad8128-37f5-4a13-8b66-02bdda139b1f", "sighting--8732ec78-443c-4fac-966e-4cd1f660ab56", "sighting--a017725f-a8ee-4de3-9623-d6082e3d520e", "sighting--3c8cfea5-3db2-401e-8f21-01e762d864d3", "sighting--e75c7866-e00d-41e6-83a9-c3a1871a385a", "sighting--ad8393ab-79e6-4075-b436-a193df3e353d", "sighting--32e7ca74-8ec1-413f-9683-dfca80e4371d", "sighting--738a0eef-8a5c-4872-a16d-feb1b9bd3695", "sighting--1be76cde-d3e1-4831-aa9a-19dcd48856c6", "sighting--5946f9ad-8cff-4c20-8057-9447147f7a3d", "sighting--86df300a-47d7-4ccc-b79c-7b68129d0763", "sighting--51a7179a-962f-41b1-94b5-e57b793c3b88", "sighting--d77be166-b5fb-4824-a214-2b8639996d65", "sighting--d1eb531a-4455-4948-abc0-721c66bb5dde", "sighting--83a3212b-88d9-4f96-bb38-20ee89cc3065", "sighting--69b30bfe-4ccf-43dd-9331-2cab0b8ba8d2", "sighting--324ecc2f-1a92-4a1a-8c34-3b23685d1697", "sighting--b585917d-5d43-4035-a0a7-70e604d2254c", "sighting--d1636068-21ba-4916-a1e5-6fd3e1ba5bba", "sighting--510c0bae-ce67-44c7-8a3c-51fffa6df7b0", "sighting--5eadb653-84bc-44eb-b24c-95f4522521c1", "sighting--14ead6d9-aada-45bf-abc8-2d560b712734", "sighting--2a6bf542-804a-422c-b119-0cf35b0cc2f6", "sighting--c69f8fe0-a30c-4b9c-8232-f5b416bfd0d8", "sighting--552a858b-aadc-4fb1-8b5e-b7c5a0bb31ff", "sighting--e29100ce-df33-4619-8dda-b4690f73bf11", "sighting--5b897f91-df5c-4688-ac66-d77647ac805d", "sighting--227d66a9-6d7c-47be-ad02-3b4846b7a745", "sighting--5b7edcb4-d45f-4530-9074-53ab63179305", "sighting--eb1283c4-37a4-4d66-9afa-e582c7693edf", "sighting--e0596a99-618d-44e8-8313-a1165c88b165", "sighting--4153cc57-43a1-464c-80b0-58c39cb3e9ca", "sighting--8dca42ad-21b2-4ac1-be51-1d27e560afbc", "sighting--73812dd7-4536-41d0-8ba7-918aec762613", "sighting--fd3ed32d-806d-4768-9269-3263b0b70bd0", "sighting--a32a5729-f15f-421b-bd13-05bcb7c0d7af", "sighting--bc949aa2-272f-4a1d-bcd7-8b525efa328a", "sighting--ecd9276c-a939-445d-b277-a138d6950cb7", "sighting--d682de69-42c2-4176-bd6e-e78273c72759", "sighting--f62d1daa-5395-4d8c-b8b4-3fa25dd98861", "sighting--dd03116c-915a-413a-aca7-bb66d83c69a2", "sighting--083e7676-9c77-4a39-9ea6-6f9e43aae93c", "sighting--3ea5914d-df91-49a9-8e5f-8d21e21b5f10", "sighting--a1c5d2e5-566c-4a06-8708-ee24e0ac7ec6", "sighting--b87d9b51-6ed9-457b-bfc5-541e733cb915", "sighting--343103f0-54b2-453a-bfa0-52d3e0897d2d", "sighting--ef77938a-fa8e-439d-b2bb-4aaf6ba592a2", "sighting--c09a6bc3-2c21-4e15-a9d5-639bf6d03572", "sighting--9367b3be-71df-46dc-949e-24268c9c226c", "sighting--f9fe20b6-9bdd-4b52-8940-63036ff3df72", "sighting--4be055ff-bf6d-4ad8-89df-8c1ca440a673", "sighting--afe4552f-89c3-4d87-8be7-83d8959807ce", "sighting--14af1bba-9c18-4bf2-88f0-444482080e12", "sighting--fc3780d7-ee09-4764-bce8-54ef521647a2", "sighting--ad815291-a3f7-48f5-822c-51e8fd4d9b8e", "sighting--b35a4eca-688c-486c-821c-1b9680d702d7", "sighting--17451f0e-bb18-4a89-8f9e-297fc4a5cc72", "sighting--932fdcbe-21af-4f8a-92e4-16aa259f4808", "sighting--4d8fec20-1fd4-467f-932f-6a68f7e8d04c", "sighting--237eed6d-3b3f-4338-81fa-12c0704f233c", "sighting--1fb2e9ff-e13e-491f-a249-47ebe6b4dd22", "sighting--762c2707-c0ce-4a10-bcb5-0517e4fedb9e", "sighting--3ef0aef9-6986-4adc-aa0f-22af45da299b", "sighting--b25d194e-0b9d-4dc7-ae43-16bad37f65b6", "sighting--d5d3e5d2-c6bc-40b6-a22c-b75150ff4c77", "sighting--43a72ad0-9379-4646-b56e-8fdbffb72794", "sighting--3f955f4b-0c1a-4939-9e88-d9507737facb", "sighting--c327b76c-8789-442d-b439-414ad83cb214", "sighting--086711a4-842d-4d47-a850-4fc0c259e940", "sighting--c0621821-afc9-4037-a862-545ad8dee484", "sighting--a474c378-f587-4704-b2de-ff6c4ee7a493", "sighting--3e50c1b2-67d4-4e24-9cb6-dcb0d07db21b", "sighting--757aaf12-5f77-48ac-a014-5239331cc884", "sighting--6e4e3ea6-d824-4521-9d55-edbd47f92acd", "sighting--ebf22c6d-64ef-4848-b6ac-0247d1f62d29", "sighting--a08432a2-7b14-4804-adda-7299f9bf97b9", "sighting--f316c71b-4a96-4b86-8826-37280c924f7a", "sighting--1dbc75d3-99f6-4341-9534-fddafdb0a1b3", "sighting--28d67055-ff1b-4054-8a65-762c9a236f52", "sighting--7f1b3fc5-33cd-4d08-88f4-cf522f7b93ea", "sighting--3008f8b3-3fdf-4f1d-b79f-3aaa96efbb72", "sighting--9cfc8be7-d60e-4cdf-8c40-a49c528691b7", "sighting--f64dba90-1fb1-4681-a831-45d6c67aa09c", "sighting--220990fb-9828-44e5-98d8-376d41f22723", "sighting--f852c2cb-031b-4889-ae5c-415ed9cc5044", "sighting--130142d3-c814-4073-84fe-1319d0474205", "sighting--aa02c1a5-286a-4f7f-9459-38e4927c36e4", "sighting--9c0d740a-4c5f-403a-9d8f-f3010d8abd8a", "sighting--bf6f7711-cf59-440f-87f6-3add04b53ac1", "sighting--5b9def63-b59b-4141-b4ab-f600eba48ec1", "sighting--71f4076e-6621-49ef-9046-7f9e83f179f2", "sighting--4109a17e-a866-414e-bce0-68e8a5fa8c7d", "sighting--cb5cdaf2-fbb2-430e-9a9d-959c7852f3db", "sighting--e2cfb9b6-081d-4a1f-98d7-43b35805a861", "sighting--5d33d075-25a9-4ce6-91ae-e7d161968042", "sighting--53a1ea98-a91a-44b1-aa9b-6896a6296fde", "sighting--22b20b3a-7304-4d77-a76c-d80e397e86af", "sighting--f6beb167-0085-4791-9461-8104a680af26", "sighting--d7d71634-12ce-4024-a893-ed98ef002c2c", "sighting--3f17b41d-2a5d-428d-8feb-21969584044c", "sighting--86c59d8e-a849-4c4f-b5c8-d9675d141f60", "sighting--ad09cdc9-4fdf-447c-96bf-1b464abecb80", "sighting--1ca35fe4-da0c-4950-91d4-c460bbab762d", "sighting--539ce474-102e-40fa-949b-9e4cd8d1a831", "sighting--0d70903c-434a-44c2-8442-6b093d754024", "sighting--276615bc-a1be-4252-933e-b621628b6a85", "sighting--989eb749-18e2-4920-8c07-46dabc788802", "sighting--2a4d3bdf-266b-4c69-b6cb-33a74eaf8539", "sighting--441b5bd8-592a-4b06-a33a-25567efd0ebb", "sighting--dde23f67-5d5d-4f4c-a45f-a0a970d51631", "sighting--0142c5a5-dbd0-4ec8-b208-2c454a10ec3a", "sighting--6d7f6a16-c490-479c-90e1-acdfff1d7ee0", "sighting--e2655215-90c8-4c45-a2c4-7571c3ec05b9", "sighting--787de98f-ee83-462f-8aa8-79f6c64bc37e", "sighting--42bca92f-62aa-4d28-89e4-043780b1f182", "sighting--93a6dd20-ca4f-4abc-a2ee-b7f6d7f7f5dc", "sighting--17449ce0-bb44-4c9f-bf27-20a72ad06026", "sighting--d7de0af8-878c-424e-8e65-f2a0c0d54f73", "sighting--d9e6f233-ca17-4b6d-b774-e6a95cd7625a", "sighting--f681b15e-2b7c-4dbf-9324-8c8052b33141", "sighting--9378a8fa-0c00-4510-afba-ce0eb773b514", "sighting--ce7de614-d573-496b-b705-2c7780741045", "sighting--370ed9ca-67fe-43d9-817c-03c5ca0d7045", "sighting--50ee5c7c-761b-4766-bc8b-f5c7cf9676ae", "sighting--c62d2a9f-7e23-4f45-930d-c9d1e98cdb84", "sighting--2df3fc88-b667-43e4-be44-13f7aff70a7a", "sighting--c0b74ea5-fca6-4042-9d80-8693913b9388", "sighting--385b3677-d356-4fe0-9b05-9f56de2572b4", "sighting--34c1e88a-3d8e-4d7f-a63a-642d8b5712f7", "sighting--58874f37-16d9-410f-8627-3f92bbe71285", "sighting--6ddf8a8c-517b-43fc-9108-6fd9f4067386", "sighting--6be25873-a2cd-4083-b6ea-91fb76cc0b5b", "sighting--dc364317-c318-4fe9-b9cf-b39d5eb9b05f", "sighting--95d64c49-13d6-40be-b7bc-cb347697f7c9", "sighting--a7239987-5eba-43fa-a61a-d27de49dc792", "sighting--30c01497-04e3-4f49-8bd7-dddeb7b90aef", "sighting--05e53234-b39d-4c06-ac85-c3e6310906f0", "sighting--466b08d5-c696-4531-bb4a-0928fdf80ee7", "sighting--ba08977d-0dd5-4cb9-9d2c-a03da7fb7ffe", "sighting--8447de1f-7979-4a1e-8e15-f77fe4bd70dc", "sighting--71944e6b-5cf3-4ab5-99f7-c59930fe26db", "sighting--29e72611-3d4a-4c5a-9f3a-d9b1deeaabfc", "sighting--4f5a969c-3382-4cb4-8185-01123112e1b1", "sighting--9f40c2f2-95d5-42fd-8c3f-32977cabb372", "sighting--60a67ef6-d7d8-4cc5-88ab-e1036f965b16", "sighting--d98777a8-5f7d-48fd-9349-54363e3387b9", "sighting--09cd4a81-b251-4e1b-a840-12f4d51d497c", "sighting--8b503b92-e050-4338-8513-969b52400fa6", "sighting--d10be5ff-844c-41e6-a554-0177cf6c83ba", "sighting--1fa6bd78-54ab-4628-bb5e-93f21c360c8d", "sighting--d0124db7-7801-4aeb-927e-936b8ccc3db6", "sighting--97601773-099c-41bf-86c9-1a0bdff6645d", "sighting--930ade33-2535-416d-b55f-97697ebee1d1", "sighting--01bf79ba-a89d-4694-bef7-303baaaac9af", "sighting--a20f5038-b5bf-4d24-af17-9be16dadb584", "sighting--7149da76-6c9b-4392-84fd-2ed80f2b19f3", "sighting--dcf8f414-81e6-4dce-834e-3c589e0d42a8", "sighting--ad09266d-5788-4c2a-8b39-02bd4bee180f", "sighting--3ad11e87-c94b-41d4-893e-c335fefb85d8", "sighting--194e5cce-5169-4ac1-8fcc-12c00bc89a39", "sighting--094e0ff9-9f44-4372-a9fa-1f010592c8ab", "sighting--bd3eee4d-0d3b-4b54-ac79-4c69838e38a4", "sighting--cd757ec9-1b15-424b-9445-318fbc8d0467", "sighting--565c11d3-7d92-4d04-9102-dd9aea96a2ad", "sighting--b083f035-f742-48ab-b8dc-8aa6c2c0f2c5", "sighting--ba6e7952-6d81-4ee4-9fea-491ec610d2d8", "sighting--5776fa9c-8d26-4a00-84ec-8fe9f9312855", "sighting--df3ac221-3870-41a5-bb5d-3a320d174f8a", "sighting--c1ab8d3b-dcb3-46f5-8a71-550dd7b2034f", "sighting--7de0f859-09ae-41df-98dd-70d7275b18dd", "sighting--dec6f87b-4906-456e-b9e1-de84f2cbd036", "sighting--4ca1260c-1652-40e5-b82a-97974028a779", "sighting--17ebb5be-ebad-4d43-a3d8-9fd285e70516", "sighting--54ec9e01-4d39-49d4-a7fa-2acf0eae6d74", "sighting--14ef847a-1c00-42a2-bd48-4f1c45f70256", "sighting--1949fab7-236d-4a4d-915e-a296ab24073c", "sighting--9a264a31-640b-4a30-b9b0-5fcf6b8e62db", "sighting--e8f4c00f-f71f-45c1-b85a-c664adbffb84", "sighting--648c7e4b-bcf5-4246-bba5-914b13cc1e5f", "sighting--82f8a792-2c1e-40d6-a57e-c9f4dcc9ee70", "sighting--480c22d6-7928-4038-9d75-236315ac241c", "sighting--d4ca2ed0-1705-47b6-b648-89727cafdaee", "sighting--431a162b-aaf3-46e7-b9af-eda1ded3c5c6", "sighting--d7fa3609-9ec1-4597-ac91-57a10b2df658", "sighting--bdfd460f-539e-4278-9fbe-ee8fcf61396c", "sighting--6bb9ce43-240c-4910-83e7-fd5fd57b1b54", "sighting--b33cb81a-6d5d-4687-8b32-8558b5d5d99a", "sighting--95b84c7d-a769-40b5-881e-0c648e978f4a", "sighting--643c439f-dc75-4b1f-849e-71e04f486cf9", "sighting--6d22c733-01fd-45ce-bb55-cb55d5559b61", "sighting--6d375adc-c5ff-4d4c-b0a4-306ec352df05", "sighting--e2868749-8917-4e05-af8d-af9dd2ebaeee", "sighting--aa3e89aa-f39b-4b7c-b748-38afe9d641ef", "sighting--528e3d34-402a-40da-8800-59708a4701cc", "sighting--f85a1ab8-a9ae-4fe9-9112-1114dcfd5206", "sighting--0d2bdf60-94f0-40b8-92d7-b56096b9667d", "sighting--ec376e2f-9ca0-4bfc-a30e-7bf7341b649f", "sighting--048d7ea2-75e6-42ca-92b4-9a8b62e86b16", "sighting--3d0cedb9-059e-47c4-a0cf-ddb0f436927e", "sighting--bbc89e46-d8d2-4aba-bbe9-9cdc5f061da7", "sighting--382eb98e-74a8-447a-870f-74d83dc30dbc", "sighting--101c3b01-079a-41fd-a27f-56c50cd9f6fa", "sighting--be7aeb85-4ea8-47b1-9fc6-dddef5e4a29c", "sighting--d8ce0ef8-d3ca-41e9-af47-60e8569cc292", "sighting--db9141e7-0725-411e-a373-8b370e3fdfc9", "sighting--1b614e2e-740e-4bbd-8f85-f12e50818fde", "sighting--e90c94de-4f14-47f2-9dfd-316a884a7d83", "sighting--01b60c44-3b90-4f6e-9b09-8f6ceb7a0caa", "sighting--cdd41f37-383e-410f-8c83-6934b5e68a84", "sighting--06ae0e55-6bd6-405e-9156-3b6a11b72a35", "sighting--688b8a32-356b-466f-a9a7-d6b01d7bad9f", "sighting--e680accc-9cb5-4305-b008-bed381c3b7c6", "sighting--e4d514ec-35c5-43a5-b36f-1c0bf911bac9", "sighting--278318f5-d0c8-4df4-ad34-d3c3f4b31426", "sighting--689ede94-11a3-4e7e-88a1-d7eee4d7c6f5", "sighting--eb61d940-d043-42af-8e2d-118613f7545a", "sighting--c020e581-fb41-4306-a54e-130bc10f7cd3", "sighting--764f3671-9e2f-4175-866c-b00876c0c2f3", "sighting--27425995-f675-4cd9-806a-b11831687e32", "sighting--7facef33-4b6c-4abb-bc75-1263ea6e1a4f", "sighting--ad6ea086-1e7b-4e92-b316-ae448fec4957", "sighting--c219e58a-fb8a-48e8-aea1-b7f61aae1f63", "sighting--c50510fe-3f99-4925-a474-fa66f9413413", "sighting--c5813ee8-2194-4ecd-ac90-2e557e3ac339", "sighting--55ec4c71-1958-4bfe-ab93-188739b6ba76", "sighting--43167bee-dee1-4ef8-911e-7f14c93a611c", "sighting--d63d7446-80fc-43b7-a91b-f750708cdad5", "sighting--2710c172-e0db-4e40-ac21-38ec9cd01df3", "sighting--7a40aca2-5b32-4136-ac27-f7acdf04c815", "sighting--345df82c-df65-4ad7-9b1f-cdaf42646b86", "sighting--5b3d8e47-dda4-4454-82bb-a2918aa5774d", "sighting--55fffdce-cbb9-4153-b800-926076b4bfcc", "sighting--e445597a-5e92-412e-b3cd-c3b941ee8a7f", "sighting--bd823121-9bd6-4cc8-85ab-971a718fe558", "sighting--22cd89ba-9c70-4ccc-a33e-c8dedc561e8b", "sighting--2d8592a7-258e-49a0-bb1b-4e13c3e4672d", "sighting--c9829dec-23b4-4079-a7f5-84339bb63653", "sighting--e99ef238-e551-4505-b484-4de060f612fd", "sighting--53ec1565-263b-471b-bfeb-752108096ab1", "sighting--9ca01b9d-4344-462b-938b-a27739612961", "sighting--d4a77c8d-30d4-42a1-a8b9-089c617c05bd", "sighting--99b9a05c-1909-442a-ac30-c8380e4c6712", "sighting--0c10d4a8-4b25-414a-8331-bb7f854e2bc6", "sighting--5e968e05-6483-49cf-b8f4-6b0c835c50aa", "sighting--5e656912-3006-4a32-a083-75c0e79118ca", "sighting--cdab441a-a47b-412b-b03d-8ae489668485", "sighting--40a0ef91-3091-4163-ae4f-abb01400f4d5", "sighting--98854e36-0f17-401a-8456-f05869461ab9", "sighting--8908a3f9-87a1-4b5b-9a34-6c7e4072a93b", "sighting--d9a26216-d7fa-4a22-825a-9431555dca2a", "sighting--9057e033-6693-4bf1-bd59-fb2062defbe2", "sighting--397844ea-1086-4256-a6be-9d020fe42ece", "sighting--7fb7b14e-a9c4-44de-ad8e-b6770e957d76", "sighting--7ad19e49-4c19-4b25-9ecc-62008038726d", "sighting--5bce5573-c07c-4b92-8e74-8779a295510c", "sighting--a5831f82-4699-4b89-ba79-9599513b091f", "sighting--808c641b-2119-4e9e-aa6b-711c5bb525fb", "sighting--9fcd24b5-2de7-4fe6-b923-cd704bbeb180", "sighting--7b87118d-7ec6-4cf2-b885-692083052344", "sighting--d605c7cc-2677-4f29-ba4e-0dcc30c95f90", "sighting--d18d4d12-9213-4db3-bd29-5474f48cceb4", "sighting--265ab6b1-8f61-4ce5-8821-104fb168fda5", "sighting--dd501d75-f772-41e0-a802-ca024fc975a2", "sighting--236a5b05-0102-4d41-a8f2-b2d98774071e", "sighting--77d53d78-0eb7-462a-a280-c9570cb345b9", "sighting--b30182c7-1da3-4273-8fdc-81bc7f3a36a9", "sighting--7e82c124-2324-4bf0-86c9-96d6d19579d5", "sighting--4c821774-c24a-493c-8051-d215f16d2c86", "sighting--ef8e7d01-df1f-416f-9a1d-781aea4688bd", "sighting--8e21f522-d861-4318-9db3-458f5f21db68", "sighting--c7496716-1d3e-4747-84a2-4c404b89a553", "sighting--a391c970-2c3d-4b69-98f5-2b97f61f131c", "sighting--8f1556ee-4482-442b-a871-25deee1bf871", "sighting--9dcf2391-7efe-4af4-92c4-60cbd39c33a6", "sighting--ea61df26-b293-4240-8e4b-28820a713e06", "sighting--ce881b01-46a3-4c28-a4f0-5ee5af99c8bf", "sighting--eda37f9f-7201-4e6c-a096-1c4017dbb63e", "sighting--9669bc74-c732-4c19-9f41-ae5b472c2ea9", "sighting--e6984cf1-92de-4d00-9c03-4b0a023a75ec", "sighting--bccd36cf-496e-4677-9229-72ae46063d47", "sighting--d7f3b49f-b93f-4476-98c8-b5889ce8aec1", "sighting--438316fd-05fa-40f4-995c-2bb876c0da75", "sighting--849c9b06-ee5b-4946-bf1a-95e71e7aa9fe", "sighting--b32da3e8-6f05-48d3-8ee1-7bccc90d8c7c", "sighting--ae512fd6-4b3d-4234-8c1f-cf3a772f7419", "sighting--44be5e0b-137e-43b0-bc19-aab33561aa9a", "sighting--36cff8d1-16da-4b16-b6e0-6e0e37ed15fc", "sighting--e0d3fe35-c4d6-46fb-b955-c4716b1f33f2", "sighting--23c2cdda-42a0-4849-bc97-50ef460bafa6", "sighting--8c49cd4d-e1c0-4704-b0be-547ef9491b2d", "sighting--d0a24b3e-97bd-4864-a568-b40de7c248c0", "sighting--b773d626-2381-4c1b-93ba-3a7f65f93acc", "sighting--3ff78239-0030-41a3-91c3-27085fe89f15", "sighting--aac67e44-7359-4cdd-af22-9cb3e3be4f0b", "sighting--39f5fe51-f2b0-4bdf-9049-e0824d899f81", "sighting--6c813bbe-a8cb-41f5-a8bd-fb0c51b5c5a8", "sighting--f90b2589-ecb2-4197-9e2b-cc6f6e98e00b", "sighting--09f9ce22-958d-4b93-b5a4-2ac1b9fb0a2c", "sighting--ceb82b10-a2a8-43d9-9ca0-adb1349554a8", "sighting--d1f8591d-e633-42a1-9559-169011f7c9a5", "sighting--cb410440-3c51-46e0-ae54-db2bb5d7a07a", "sighting--32157498-86bb-43d6-81fa-1e2ab643042f", "sighting--1a09a2e4-0e10-4912-917e-667b85b79f9e", "sighting--a1d1052a-49c9-4a01-b16b-c30b61824faa", "sighting--1cfc6423-a149-4545-9dfc-0ac8f7013a4d", "sighting--b10a94b0-02bd-4fca-9832-2f0a4f6df21f", "sighting--966986e2-481e-4465-b979-c67ee002ef19", "sighting--795678a5-bd07-4335-9417-e5c8e4868175", "sighting--0ec14bf6-c983-40bd-9c36-4aa24136d02b", "sighting--120c8864-f2c9-4519-9991-76ea45631ee3", "sighting--1427a93f-83e6-40c3-a6de-d302301ab85e", "sighting--0ea3be40-dfcb-4f7d-a59f-14f5f36f4a61", "sighting--98ed10ad-fb60-47c1-a9a9-228fdbd50b41", "sighting--d2cb586a-e186-4868-a075-9f77e3d6749d", "sighting--aec7c612-a55a-4736-a58f-d40770c7522c", "sighting--94269639-6591-46b2-bf06-aa113ce739a4", "sighting--91539d2d-9666-4401-a589-632802f2414c", "sighting--115e759a-9e47-4bfe-8763-4327e7161bb6", "sighting--52d29495-0de8-4c0f-87d6-4742ca67d51f", "sighting--259dd40f-a96f-47f1-98c6-c68abb11d829", "sighting--03f1d01c-9cdb-4416-8fc2-66c8aeef16b0", "sighting--9b6f9be4-ef72-4e27-8cff-925b8623af19", "sighting--43c9e14e-1387-401e-a41b-6cbf7df49525", "sighting--a03bd9e8-1786-4a3c-bfc1-40181f076a13", "sighting--8137b94c-e4b8-45c6-955f-cc4bf940881d", "sighting--533a595a-0024-4f53-a04f-5fdf4ec1e073", "sighting--754bbc5b-fae5-4754-9f5d-27cddd8f23e5", "sighting--c3cc833c-30ab-4fc9-aa73-5106efa83bf6", "sighting--dda140ba-c003-4040-aa57-44f64a226279", "sighting--3107ebe1-23b8-45bd-9673-2d4515610698", "sighting--e6b352e3-ad9d-4ded-91e1-1a39de94c49a", "sighting--6f91ebb7-4668-4346-bd29-7ace96d5bdec", "sighting--d8282c18-38c3-4696-b0bf-ec77101995e4", "sighting--08aaf651-2c30-4b1e-82f5-fac7e7343e9e", "sighting--b945350e-e7ed-454c-8fac-c123bf007d45", "sighting--3de85780-f040-4f3d-a9ee-f5e446d0cc04", "sighting--614f63ad-c54e-4332-be3d-c4079b3cc0af", "sighting--55361dc2-ba45-4ba4-8952-60fc99f18ca9", "sighting--dd426115-a0c5-4c20-aeaf-88d515053ff6", "sighting--c417316c-1456-464b-93c9-7958deaa4fae", "sighting--df3f3076-f1a9-4f6a-b181-699685a7f523", "sighting--09a237fb-6c94-4e42-87af-69eb1cd6a677", "sighting--222f87a6-47cc-49e4-9f24-a123c8adc920", "sighting--2bef626c-e0ca-4a36-99d3-70a6489f229f", "sighting--aa4d443c-24f8-4bc8-8681-7e7a7fdc90ad", "sighting--582fe317-82c3-4d40-95e1-fb6040578982", "sighting--2e2cf9d6-3d07-4c4e-b237-f5070cf1500d", "sighting--fcaa7211-adf4-497f-b3a6-3bb5b3b87489", "sighting--ae1856d7-d150-41af-abc2-0d944118ec84", "sighting--23e68616-b06b-41c0-bd75-651adb2ba357", "sighting--efef9e62-4337-41b7-8344-b85f679813da", "sighting--72da73d3-824e-489c-97bf-f59f5a7450f0", "sighting--cce8d83c-4753-4e62-a6ff-fc38c9c7e866", "sighting--56c28ac3-308e-44b0-a514-a305c72a7464", "sighting--09b45741-05d1-48f1-a5ec-557235dedc27", "sighting--385c9abc-354e-40ae-b951-a99d637e9f0a", "sighting--c6979438-7bf7-4f7b-9c9d-3ea0c271e4aa", "sighting--3b3125cc-6492-4ee1-828a-108111ba3d28", "sighting--6528cf96-77fe-4ffc-9d8d-7ea9b541ab7e", "sighting--3505248e-e94b-4116-905a-d5f855b6eeb5", "sighting--aca07c72-b6ca-43c3-90e2-c6023a9797fb", "sighting--998e75c7-e97e-43b4-bcfc-cbbca4ce047a", "sighting--f6b09fe3-2f78-49bb-86c5-139ff141ecb5", "sighting--6bf1be8a-b145-4650-b326-94b45cf187c3", "sighting--1de03a2a-9013-4a8a-8f83-728c494de6c6", "sighting--abe29a9d-7e7c-4178-bc68-0a20e9aaeba2", "sighting--a16144bb-1844-44d4-b6f3-0b9685f73637", "sighting--42b1507e-877f-4ed9-9fa5-0d1883761cac", "sighting--5affcf26-7a8f-4303-ba16-b5ebcb4093f9", "sighting--6ef87b8f-8138-4dc6-b474-56340b0f258f", "sighting--9555ac34-ead9-497e-b428-fdc30bf4dd1a", "sighting--78aa2fbf-6d2f-486a-a23f-c4b81f5b1b03", "sighting--e35c7235-8b3d-414b-9b75-a842397c76cd", "sighting--c4506dda-6e1b-4487-9b14-fb0e6f3d4d14", "sighting--3cb0fc79-84b2-4b0d-b4d3-96396b71954b", "sighting--f6e37950-7522-4890-8372-6d4e48d7fe10", "sighting--d00b9b7f-c144-4d7a-aa6b-52de938d9c87", "sighting--fa9a0c41-13f6-4128-a2ee-ea157f535d98", "sighting--aeda0406-cc7e-4144-9e60-f7967aa1fa6c", "sighting--ac7b3ff5-a64a-4076-8574-e22c3be2f9ac", "sighting--f3d64dda-9583-43a3-bb94-087f8c127c4b", "sighting--4a66d9d5-a5b5-409b-be49-0b272867b509", "sighting--0d82521c-574e-4a5b-b44d-71718ab323b4", "sighting--682762ca-63f3-48d1-9198-9852bdbf23d7", "sighting--ee96605f-3b93-431e-8ec7-3cebc7d8733c", "sighting--ac6cf5f9-4ff5-41c4-8024-9b73a24b7990", "sighting--b77607ec-a00c-4a5b-81f7-79ece784d46d", "sighting--5fd8e6a4-7ed4-4195-825b-45cb1b39b926", "sighting--19b5babb-c56f-4d16-84f4-75eb16989f05", "sighting--2bdcb8d4-c34e-4700-84f3-cc069047a1ea", "sighting--41b08ce5-981b-45eb-b2f0-2943d25aad08", "sighting--e7442794-ce71-401c-a6c2-ca14f836915f", "sighting--ce1436a3-240e-461b-a17a-1512718fbd21", "sighting--40860b52-24d4-40fa-9a34-f4039892d852", "sighting--82449cfc-ba69-40f9-a60c-61d928d7e0f3", "sighting--4e725fef-f26c-49d9-be6e-d5c753d81ba6", "sighting--1cfbcd06-103c-48b8-a027-aca730519ace", "sighting--df74b867-c345-43d8-b019-d414957d79fa", "sighting--8b7018c5-3fef-446d-be0f-e823ac39fb1a", "sighting--dc29b5d8-d7d4-400c-a913-2a1f9ea0b595", "sighting--4d174b68-cbde-4e67-83ed-fa35723a61ee", "sighting--a48effd8-3867-4d3d-a5ab-11df9aadda77", "sighting--aeced2f4-22b5-4bf6-a78e-b9bae45ca88c", "sighting--8c1d1aed-0fae-4576-9624-eaadbc3d8eee", "sighting--51938438-db1c-46e0-99e1-81af39e4425e", "sighting--717e34d8-6e3e-477a-bdef-e9c004aaa1a0", "sighting--cb3194d5-02d0-45b2-9e11-ad19f62535d9", "sighting--59261911-ef23-4252-8cbf-37d14f015feb", "sighting--0e26c270-397d-48c0-ab77-43233dc66a6b", "sighting--9eaf9fbc-bdce-41b4-816d-3a479aea2505", "sighting--2e2077be-60ff-4ada-a3a9-3a58fe5bae64", "sighting--1e963805-329e-4652-9648-af94065e7b52", "sighting--16ff6f65-8817-451b-b1d8-61064e928293", "sighting--62e51902-6cf6-415e-960b-e7782ab199ab", "sighting--41d5ec91-2039-407d-8d66-af092a09917d", "sighting--e09b797e-a322-4f4c-bb19-c7e80385f41b", "sighting--e707b3e3-0294-4139-a6c2-f7c002008117", "sighting--cda552fc-688a-4a77-8114-f9979d8a0604", "sighting--60361fac-ea1b-4e3e-bf48-25e549cc0568", "sighting--b5183a36-64cf-4bde-b9aa-580750439aa5", "sighting--49a04eba-a318-4ebb-8d19-bda25797ef91", "sighting--54a7bb90-026f-4573-ba99-9268f64906fd", "sighting--cc4f2222-e2d9-4c82-aa6d-1e05df5ecf46", "sighting--c0b8c2bb-79fb-4000-a5d7-dc4d89622f0c", "sighting--eb73054e-e007-47f3-b0d1-fc4c58f546df", "sighting--0566c72d-3912-4de0-a293-5490ad469ff7", "sighting--3cea84ad-b7a2-4264-8268-3eb3225ebfc3", "sighting--9fff4df1-89de-4eab-80d6-afcd98c12272", "sighting--0b801871-3147-44b8-8f93-99bcfab2752c", "sighting--8eb5e639-83c9-453c-8d7b-196d9b932a68", "sighting--829260f5-c6bd-417d-8063-f5cb1544ff61", "sighting--dd7a7577-36be-43ae-b7ce-6d057ea3037d", "sighting--f7d18222-dfb2-48a9-acf0-23e1b88c4fa4", "sighting--93934a8b-dcd5-487f-94b0-03b254f647ba", "sighting--8256970c-a38c-4f88-84c7-11830346842b", "sighting--1a1026ae-0cab-4e68-8dd2-745cebca2fff", "sighting--ae6e385c-ad55-452c-ba61-d3cc00f5ad9a", "sighting--6425a9d0-29df-4924-a5d6-3046bb381c34", "sighting--992fc76a-3eca-4469-8f2a-78dec62db86a", "sighting--e4ddbc8e-f294-49d4-8dc7-9fcb0356cdd5", "sighting--a3da4dc6-68bd-43bb-9a12-8b408a80790b", "sighting--b54859a8-b264-4028-aa8f-58c0b6aee09e", "sighting--013f5935-4156-43a5-8494-6a54453876bd", "sighting--3ff2c5cc-42df-4d0f-a34e-80844791e632", "sighting--29f209e1-2ea1-4301-8403-964041791313", "sighting--96378570-b3bf-4647-bd44-eebc7f748705", "sighting--037197f1-446b-4e4d-92de-e68cc1a77b4e", "sighting--0f77dea3-8360-4ca2-8582-2c22ec08309e", "sighting--15f568d7-70c5-4ffc-9433-1fc3c05a8562", "sighting--81fbd4aa-3f59-46be-ab30-4ed549527221", "sighting--b2a79a5b-4ba9-4885-aa3d-41be32b4ee66", "sighting--936ef4c1-8322-4bd0-93c3-ee09037c7301", "sighting--8e283202-2ee4-4ba2-a10c-731d15981270", "sighting--644e05db-5b97-4870-bb4a-8cec36155139", "sighting--9801e64f-3800-4abb-af89-89f9ff73dbd5", "sighting--446be738-c949-48fc-9409-7f0c766f96ca", "sighting--737bc136-ee03-4fe1-85f0-85f6e86cd59f", "sighting--efa1df41-3cfe-482f-9eeb-9100c35d4a46", "sighting--a8e31e32-a349-44b5-b730-f78202f5191b", "sighting--650ec589-0d8c-4a3c-868d-65938bd44f37", "sighting--e252f7e6-9174-4ece-96c3-2aa63bf39022", "sighting--6e86f464-30b2-49d6-aadd-48557ee02da5", "sighting--39fd09be-4fd1-49b0-aa64-1540dc248906", "sighting--6f8f9baa-d9ae-47c9-b34d-597bde118ade", "sighting--0c7b34fe-241c-49a4-a90f-fe70b90e5608", "sighting--6bcfe261-b35a-4843-ae31-5ca8601df483", "sighting--1c2b84eb-91c6-4da0-b3ef-d81430c429bb", "sighting--e71f47dc-9290-4209-97df-afb71316ef8f", "sighting--9ae5fe60-8043-4b5a-85f7-ecb07c94eb77", "sighting--ae0caa96-a244-4b34-8bc4-3a873c2a721e", "sighting--d0cbaba7-b61a-4932-a8ef-a8b74d785934", "sighting--6eeae22f-adaf-4949-b514-9a1c01420332", "sighting--c973c8ac-e12f-423a-9aa4-d875f94b85a7", "sighting--e5229077-2d5e-4c88-b78f-1ee3c1505ff9", "sighting--d9e3ab7f-a826-4d77-979e-d97567429b55", "sighting--c1cf74e6-936c-4a39-b691-3be95eac0e09", "sighting--b9e2af17-55b9-45b8-b9e9-c7762e8c815a", "sighting--01a1d628-74ff-4601-8208-4d28b949f531", "sighting--373d6249-8f34-490a-9f26-118f31a8c44d", "sighting--201e9943-7d12-4648-b50e-8cb13ce36afb", "sighting--e7080f0f-12bd-4579-9757-fa87b3cd7051", "sighting--dc262071-e9dc-462c-bb6f-01220432c764", "sighting--a8be23c7-ee53-43b5-9dd8-d7203942b14a", "sighting--13f33293-38b6-45a5-92aa-33f722cb5525", "sighting--f5c69798-2b6e-4693-9cdc-ba2c0c17a548", "sighting--d21cc502-c8a9-4e7f-aadd-e2eed30b0658", "sighting--f31ec845-1846-47af-97f9-a0ab14650bd3", "sighting--b6b5f444-c472-4f38-922d-28edd58b9494", "sighting--c4b4c4c6-0e3d-4d7e-aaee-70e1f76a0d56", "sighting--aad02f2a-201f-457c-869f-de9ecad9c2fa", "sighting--bbccf8d4-2e6d-418f-ae9f-e48aff3640e9", "sighting--63820775-5dbf-4ca8-8f2c-4a80db3d0bdb", "sighting--796e140f-0127-4935-8b81-55caffc2082a", "sighting--9bb68a20-9604-4dc3-b9a2-103c41c190b9", "sighting--d215a79d-7bf2-4946-a787-05f91beb85f4", "sighting--9c53b602-9711-4c54-9507-7f92ab442e5b", "sighting--0b3863a8-e59c-407a-b58c-ffee775a58a9", "sighting--6a4d7eec-8d7a-4124-86a2-c325e74e8a92", "sighting--ddfe6fb2-cd34-42f0-a223-0b743a14223c", "sighting--bd671416-50ce-438d-b922-f2c01d0a6765", "sighting--936ca3d1-1607-4f0e-b82b-fed4bd7a0a7c", "sighting--a5f7e940-8624-4c09-81dc-1d492bb9de5a", "sighting--1f0c7a6b-676b-4bd8-9a54-9b8780b3e861", "sighting--7b74581c-af0e-4835-9884-830f57afe219", "sighting--0f4bc271-b32d-4737-b96d-5b479fbd470e", "sighting--68a36314-4ef7-4acf-a0b2-038ac1d27be0", "sighting--8da01686-6634-48e8-9057-fdc10eb5dc93", "sighting--0aea6981-c82f-4f7b-b55e-470bc5a83f7a", "sighting--696aeb25-beac-425c-b813-f2a71a8c7f82", "sighting--ce67a4d2-767f-430c-b6b5-7aaf44595878", "sighting--45ced328-459d-4711-8289-7994854a9aaa", "sighting--280a5195-29bd-4758-83a2-df72007ad813", "sighting--7794dffd-f1f9-46d5-bb38-c1a3b4eabf8c", "sighting--52954369-359d-4e89-a15e-cc6870320025", "sighting--31f3dfa4-d47f-49a2-a120-09643f998135", "sighting--486d4fe2-a5d5-4199-9a01-179638aa76b0", "sighting--e7530135-1a93-4944-a52d-534bb1a0a7f0", "sighting--3d7cedcd-f17d-4f95-b8fc-f48489bad5f6", "sighting--fcc17f17-89ba-4f33-9ced-ce6d32d22f61", "sighting--d0816ed7-6471-4551-a586-5761a29ea944", "sighting--abb721e1-1c9f-46cc-a0a5-184b4c0b173b", "sighting--bea94fad-9a9f-4461-a4a1-310cda18d1c2", "sighting--49387a7e-8d31-42a4-ad39-f381acf02405", "sighting--7795ce70-7c80-4aba-bec5-9dd0731b40cd", "sighting--0c6059f1-a545-4b4f-8f48-6aeedea4bb4e", "sighting--480d4eac-593b-42c7-935d-0de06172a0d5", "sighting--f94df5ab-ead7-47ea-bbdc-27e1df44fd19", "sighting--c604da3f-8814-47e7-b2e0-0ea68458013f", "sighting--a868bd66-e3d8-46d8-a6f9-f682918c2a09", "sighting--5c2c25b8-e49d-418d-bb3b-3243ef6f291e", "sighting--27426783-fd00-4971-be76-a4e519a32423", "sighting--9d3aa923-9745-40c9-aa10-967ed69f109d", "sighting--3d3ba9a8-dde8-42b0-bee0-5ec75090dfbf", "sighting--d44ba1ab-bff1-43c8-8b1c-d1bf59c39ad9", "sighting--6b741c72-fd6d-44d0-9db1-9851105e2693", "sighting--a77a04f0-a269-42d3-a481-80cef2d21441", "sighting--176e5a67-e116-40c1-a036-e3aefdab4230", "sighting--349db090-d6a1-43e7-83e5-3362fcde6f34", "sighting--487898ff-a9e9-424c-aee5-7abe588884a7", "sighting--4038609f-916e-4817-88ae-d8e204cde50a", "sighting--fff5bbca-a292-45cf-a69c-2e5531a5f87c", "sighting--4e5267de-642d-45ee-8449-fe1122686602", "sighting--0e2a5592-4416-4f68-81e0-4b0f2d4be93c", "sighting--9ef4a519-9288-4717-8c70-2cd524355578", "sighting--3e7d1e7d-3064-40d7-ad55-77eb3240e458", "sighting--f1d1e780-b58d-4b76-8528-e52adff3bdcd", "sighting--e89ad6fb-5c5b-48b0-8cff-d3ff869825fa", "sighting--cd65816e-515a-489f-a391-f7f7059c8c39", "sighting--fcbf0e6f-cc98-4d7f-b5ff-1e6c0f26f820", "sighting--180eb2c1-064d-4f62-b089-b2f108311487", "sighting--7657a9d5-2f08-4850-b34e-c78bbf1d3edd", "sighting--e05113ba-458b-46ab-87fc-6148531af5a1", "sighting--fa8e16cc-b67a-40fb-8fa7-fbc2a22616da", "sighting--e082b53a-754a-469c-8003-555c15f50a45", "sighting--c9f14027-677d-4db4-bc86-d8f72ef9d9e8", "sighting--b89c7b38-8978-4e56-be01-dfd354450fa6", "sighting--469acf8b-9f68-4d6e-aa40-955419b7c3f4", "sighting--117dcc17-6cc4-43d3-97b4-89a47217bd7c", "sighting--43b5667a-1df0-466d-ac5c-d26cf472e31d", "sighting--5e8ed3f1-0c76-41af-b646-d2784d1665aa", "sighting--ff296e88-b5eb-400a-887d-ca7ac1b14453", "sighting--f1d91442-86e1-4614-9bd5-b6b151af4afa", "sighting--3572ae26-7119-49c6-b70e-31e2aa440e94", "sighting--17cf130d-cab3-4109-8c3c-bf0e3eca67df", "sighting--fb4fa2a0-4095-45ed-9f54-af0cbcc67f28", "sighting--a612c703-0f1f-4f4c-ba51-fe57d9447141", "sighting--76b1a378-10c9-44d7-a9e3-8658b15b0989", "sighting--fa9202ed-ca08-4d90-8325-91e32f813b8d", "sighting--35ac669b-bcce-4690-a388-fa282c267ebb", "sighting--ea345f91-f6de-472f-82ba-3031cb6ece9b", "sighting--9d6ac09c-00f8-452a-a8ba-f7b97c91a4a4", "sighting--d9011f49-5a6b-4fce-8ada-3d4de69e9373", "sighting--d138e5b5-596f-421e-be98-794e4d0f3a61", "sighting--b4d1d1c0-dd56-4b48-899d-83aaa8ee33cb", "sighting--12c43194-0be8-4603-b48e-7cf9e3e776e3", "sighting--76b3cbf0-1f50-4247-b3bc-4ab65e9f30d7", "sighting--3338dcfe-afb6-44ad-84e3-a5ec12046e29", "sighting--68a98263-8cbd-4e8f-919b-87c53cea3916", "sighting--727108f0-1b29-439b-bd65-d0621b258281", "sighting--9cdea1dc-ec90-4f03-88c2-7150d5332eb9", "sighting--7590daf5-8608-4b02-960e-da6d9074b985", "sighting--cd07def1-062f-4f02-94c1-991ce52e806e", "sighting--52e882a4-e79f-4dd8-8a1b-024ac44272d4", "sighting--7813d78f-a6ea-4069-8bb8-614cca6d4641", "sighting--86994b9c-c1e0-470d-8c07-9c1cbb1597d4", "sighting--5f45da41-7041-4667-be37-57cb778acac3", "sighting--0628184a-eda6-4d45-94a3-35a7c972d36d", "sighting--fb8c0243-c2c6-4305-bf1e-bafe004e4240", "sighting--777be642-497f-4147-accd-569462707786", "sighting--8dcea044-ab14-41e0-aed7-353f42b59bd9", "sighting--91ad9ff9-04dd-4b57-ac98-6c1550e6bac1", "sighting--1bd1effc-236f-4571-b522-1d720646acbb", "sighting--13a0b1e5-e508-4f0f-9d1b-8059875a5627", "sighting--44514f8b-6437-4da1-ae33-8732d2464601", "sighting--165ec620-8439-4749-9cdc-d91d20cacd3c", "sighting--cf181246-28f5-43c1-a5b9-1783e08534b8", "sighting--3f938025-6bb2-40a2-9eb8-3d72bb65d8de", "sighting--525947dc-0cfc-422b-a220-924241446126", "sighting--27157bd5-590a-4e51-8177-35318552df59", "sighting--4b6cf40b-9b11-4acb-aac2-cee1fdedeba5", "sighting--751e4291-77b8-473c-a0d7-9715ddd423b7", "sighting--c680212e-342f-42ca-b5a2-14b7d0a39d10", "sighting--387a1fa7-be54-4084-bd87-2b815d5b6a6d", "sighting--4ddfe1a0-3ed6-4d0d-8d46-dbfcd696d194", "sighting--8b9ccde5-9100-4c89-8251-252b8548e769", "sighting--fbf9f646-0cfb-4141-a0fd-d8cf28958d41", "sighting--8183cec8-5b8e-4252-8ff0-329aa7dcc154", "sighting--f9abaa20-6b5a-4ea6-9ce0-5ab8ff7e14fa", "sighting--d62c775e-abfe-4920-a22e-7b85b65d9cae", "sighting--d2b00b3c-6305-48a3-98e1-51a211087be4", "sighting--40a59b1d-1f02-4556-b7e1-2b961b3ecbb4", "sighting--fcfd9f4f-eec7-430a-b693-3ebb96280a9a", "sighting--35f85217-0490-4376-b524-cb1dc6ac221a", "sighting--6cbfe77f-9067-4b5b-85ed-e94d91dd7fa6", "sighting--e31b040f-ffec-416a-a568-f5637123ec5e", "sighting--61d80664-396f-4caf-b8e5-85baea59b655", "sighting--71b1eebd-d888-4467-bf57-4a18dadee050", "sighting--7a7940dc-02c1-4af9-bfce-d284e55e3092", "sighting--8cc0eb3a-ec7f-4ba2-b6ed-5f3924773912", "sighting--3d19ecd9-54ea-4563-b97f-cac6fe1730c8", "sighting--8d9e37e4-6429-4217-b2be-5d1b74e57936", "sighting--07f7ce5d-544f-43b0-b24d-00a282af2e73", "sighting--661b0b9c-a3cc-4980-bff7-1d600b479654", "sighting--5a04f639-4143-4ee2-bb45-cd0b2125f994", "sighting--f4bc1d27-82e0-44ca-918d-6ebdfb96275b", "sighting--ff3626b6-b280-4dbf-b467-280f6c8b2df4", "sighting--fcbe6246-78fa-47f7-b71a-8ec1ecd2fdab", "sighting--b7395ded-358f-4ec1-9c40-b9f76c24f90d", "sighting--2f0e3b6f-2332-41ec-a8f8-d2c1f9555b75", "sighting--e5559d12-a3ff-4028-837c-4e7c36a4f173", "sighting--6cfa2379-a54b-401c-910f-1d55c68881f6", "sighting--25587470-a08c-4d36-8a07-300117245bcb", "sighting--b7f534d7-309c-4575-b7a9-eaf0a4866c8c", "sighting--f416d6d0-795b-478e-91e8-4463001cbabf", "sighting--d16df8b2-244c-4b92-9b71-8deda43773bf", "sighting--db98bf77-02f2-4f3e-9dab-6964f8745045", "sighting--71201f9b-5fec-4735-b33c-279b722d3a25", "sighting--fe99de2c-ae41-4ac5-9cd5-a8f45d549ed3", "sighting--2a1eab47-313a-432a-9e42-45e25b691f45", "sighting--c325a70c-ea46-4065-9470-b00928ad3d63", "sighting--8a0b0a37-efc7-4a34-95d1-e90be2dea6de", "sighting--d2982f7e-9a6d-40e9-bb4d-a142947a2a0f", "sighting--4f08f802-2d54-4c09-9ef8-fe02aea4a49a", "sighting--47188cfe-f6d5-472c-b0ba-8ad3529f3aeb", "sighting--23120785-7586-4cfc-9502-7b300b12e819", "sighting--fbcd3b11-e4c6-4eb3-bcdd-8c12c56e4778", "sighting--4bda5278-2f56-4b8a-98ca-29d1c81d4d3a", "sighting--1685e819-7a47-40da-b86a-074d7f2b0b1d", "sighting--d1b5a4c6-ce4f-44d0-b70c-6ba616843cff", "sighting--e52a5871-73ae-44a9-8e92-cfcca2c0e8ab", "sighting--f0809eca-939c-425f-82c6-6c65f9abe4ba", "sighting--3d0d076f-c41a-493e-b5bc-02819e138d7c", "sighting--95dc7487-2bea-485c-803a-4b47c364aeff", "sighting--bcf8fdd5-6e3c-4e1f-b256-076e30a28ab6", "sighting--770cceb0-c88d-47bd-87c0-be7c60dd6682", "sighting--f5fa59c9-364c-4500-b1c8-1d42d81f34f8", "sighting--bca2ed99-4bd3-4536-8605-0a54f72b7d88", "sighting--87ffc24c-cb92-4492-ad86-6819159ab9a5", "sighting--ef02c1cb-d569-4b3c-a57a-86112fa219b3", "sighting--853e591e-9294-4e5f-9346-afa5f1d1dd05", "sighting--eedf6e5c-0d8a-474a-a4c5-bbeb2d5a3c9d", "sighting--8f515a34-9902-4616-a14d-98e2edeae9fe", "sighting--ed70926c-ec5c-48db-8b0f-c9bf2f62d982", "sighting--1420b425-3b68-48e1-9a44-c8b849b40559", "sighting--c53f518b-d05a-454b-b46c-2e67091230ec", "sighting--49f3b987-d04f-49d6-9741-2e41166581c3", "sighting--8db8c816-07cb-4645-924a-8f59b41a4f7c", "sighting--08bd94de-47c5-46cf-b15f-c7221168dbf2", "sighting--0ad7ea57-9880-4dd9-ac84-ff7666e1bcee", "sighting--7620ce80-33d2-4e04-885f-1817588595e2", "sighting--df117de6-67bd-4f0c-ba53-9927ef60018c", "sighting--5053789d-97be-4e8d-b9ad-48196d497368", "sighting--942bdfd9-1756-4dfa-b4af-159bb2a3dc5f", "sighting--8f71ee81-d010-48b4-920c-57e0f61ce235", "sighting--deecd584-da39-4811-ac23-02b2b71505dc", "sighting--df7006c2-7949-489b-afd6-a7561b5646d0", "sighting--5f8defbb-3ec3-4f8c-a412-33ea3e5294c0", "sighting--48a37b42-de23-4b14-ad0d-6882a420d6be", "sighting--ae46d09f-4e83-4747-8953-e05b4422dd56", "sighting--41382980-7a0a-4197-bdf5-34c6d98768e5", "sighting--bd984d3a-0fa0-40b0-8ac2-05ea038c2c0a", "sighting--fe9c1078-3ff0-4862-a676-df50878f5e3e", "sighting--f07b7870-3326-4a6e-8eae-edeb3430ba79", "sighting--82ebd78a-bf51-4a50-a7a1-a6a0294e69f3", "sighting--f608f1a8-2eb3-4cf1-beed-bf4d790ed5c3", "sighting--298d052d-8bc9-4abc-a558-642eb5c7b03c", "sighting--78f1afde-7d60-48ce-affd-9906992ea07c", "sighting--44873e73-51cf-4a92-a036-6036ffc4f7f2", "sighting--c351884a-0cac-4935-bcb6-6a0383c109dd", "sighting--97cd0fe9-e973-4b45-973f-b298d741b8eb", "sighting--73251ed3-d339-4e6c-822b-998328fcd4b4", "sighting--5b194acd-3738-4ba0-99a3-8799f082ecfe", "sighting--30bb722e-961b-4067-946a-3c4b0eb82962", "sighting--64d888be-aa91-46ba-8034-ed0a6dd23c05", "sighting--7c11c8ea-d149-4811-8664-9abf26505136", "sighting--623ca00e-8c18-4299-9cba-aaabd2b79ce0", "sighting--51b1f692-ec9d-48f2-a048-a7b49e90b43e", "sighting--0f331c74-9cf0-4d2f-a480-90a596495c08", "sighting--f170bb6c-7ba3-472c-8292-a919802a123c", "sighting--22d738e7-98ea-402d-82be-0ec17f265b7e", "sighting--48f991c4-e02b-4f10-9d95-bb93926d8b6f", "sighting--5de33e6f-5f9a-4ee3-8d98-c7162431102c", "sighting--b287ced0-8a3d-46de-91ee-9ccd44683a5e", "sighting--fb9ac71c-688c-436b-bc7b-67676a754ed3", "sighting--1f67386a-1308-4beb-8559-9dbe8ee4cffd", "sighting--f51d0225-a0f0-4598-a4a5-7bd5e734937b", "sighting--52911ac2-ad1d-43fc-bee4-5b0371b1ef27", "sighting--b666d522-d67e-4515-9efa-37efcc4f689e", "sighting--9c621530-5993-4f8e-990e-d4874bb3de66", "sighting--475c70e2-c0d7-43cf-85fa-e4e476565977", "sighting--0be0f3fa-c91f-4e78-86ec-ca1e486aa25a", "sighting--171d25b4-7419-4d8e-a821-3084afa99aa2", "sighting--718089fb-9bf6-441d-aa0c-73ea74aff4c3", "sighting--6278311d-5418-4964-a5f9-5317a64d62eb", "sighting--81b1aae1-d402-4014-8001-a7673f724efc", "sighting--3822e1ad-2b81-4a39-8bbc-e3cf6bd2cb62", "sighting--6cca189b-827e-44a4-9718-b9568385666a", "sighting--39c09627-7756-4d0e-beb8-f27878e76064", "sighting--bdf8f6d7-bdbd-4d41-af07-8de4b434ff16", "sighting--2ef6a241-01b8-43c6-814c-e46dea7ff511", "sighting--f2b7a6fc-01d4-49d0-adbe-85f96d1c7bec", "sighting--efefa377-6a35-43d1-baa5-2a8e9d08a45e", "sighting--345996ae-a417-4906-a764-1c798bfa7fea", "sighting--d4cf7759-0355-4729-b8f6-83685e91fe57", "sighting--05066417-0df7-488e-850c-7f08ab6252f6", "sighting--4e10126a-7a6e-43ac-bc71-b564fdd90225", "sighting--dd490ca7-b9c6-4b28-87bc-e91eb0882cd1", "sighting--4730970d-2576-49c7-91b2-cd618f3f1787", "sighting--419fee31-f88e-482a-831c-c65d4ea6e87b", "sighting--58393acc-ce8e-4a8f-99d1-cb8d0bf699b1", "sighting--cfc58ca1-47a0-439e-bb6b-93c916572227", "sighting--15d3fd8e-fe5c-42f8-8dfd-b0917694c2e7", "sighting--31a76eaf-3d13-4bb2-95a6-6f67b707ef6b", "sighting--1b43ea33-715d-44b8-9288-15587aadb54b", "sighting--2a6e9363-9667-4394-baaf-69e8b5f33608", "sighting--b7cddb9b-4209-47fc-87e1-f6f37463c903", "sighting--1ac8bcdd-4c80-4dfb-b712-72404e6f7d87", "sighting--a9dabb27-75f7-44b7-917e-7d8e0ca57dde", "sighting--2643fb9f-222b-41cf-bbd3-16537a8d51b0", "sighting--2ce1dcfd-3fea-4789-a251-8c579871bd38", "sighting--91b06e64-3ecb-4f6e-8d24-218ded2ddc8e", "sighting--b3b2be19-eb3a-4029-b1b6-ccc381069f0f", "sighting--9485e7b2-7a45-498c-9975-4a30a31bb7d9", "sighting--95ee1183-b061-4c88-9f46-db723e076c73", "sighting--577a9966-ab44-4391-8c5c-3b21a5571a0b", "sighting--5f6de309-e9b9-4637-a2eb-5698ea3a2696", "sighting--a1b3655d-b9c3-4f96-a3f3-a0626101a060", "sighting--b4d1a51c-cb03-4f55-bb7b-e850307200e6", "sighting--722ef993-2a44-4584-9ced-2ca9ce07bd17", "sighting--ffc2858b-3590-4cd2-88a3-b6e3d8465707", "sighting--ba2a1bf7-0325-44a0-9667-d77db23cd2e4", "sighting--772f6435-6c88-4777-9f92-e627879456eb", "sighting--70c7f154-5c3a-4bfc-a3d5-49df8a250c68", "sighting--fec82110-e9d6-453e-b136-4dc3eb48d240", "sighting--0830bd0f-8031-4012-8edd-19e0c3e1d3b7", "sighting--75f4bac6-98da-4914-81f2-f2ae40f72c68", "sighting--3546468d-7463-41eb-a46b-11e07d22dfb6", "sighting--ae30bcc0-5c89-4edf-902d-1c48500f2023", "sighting--77a87a38-5233-4762-a173-8ca0c743257a", "sighting--e43e0570-2299-4a37-a980-b355a2dd0631", "sighting--250c848e-b83c-4bf4-9957-cf1cd8e710a1", "sighting--30d5d779-6df5-4e96-a20a-626c9c1c41d3", "sighting--67822aac-5c82-4f96-ae79-589695add030", "sighting--2b6dd724-120f-4db0-9d60-ed5e3fe342c3", "sighting--e15b7b91-24e3-40b4-9e1d-25c9712673be", "sighting--fbbde9d2-5299-450a-9e9d-a4d2a27a9d8f", "sighting--5544d21f-27e6-4095-928c-72976fef11b8", "sighting--807faf67-f639-4913-b429-c288b82da6f0", "sighting--5808a672-eb9d-4969-8e78-c0ae8672444e", "sighting--3fdf0ea2-c4eb-473c-87a6-a9462ff603f2", "sighting--dcfbdd81-d566-4933-9c45-e321b3286528", "sighting--3ee68c80-9aec-4a63-b516-2911e8b0fd60", "sighting--df8b5023-92c0-4bb4-914b-4e41d90c184a", "sighting--fd4fa6dd-2510-48d8-a484-9f9993895e79", "sighting--fb4a455e-327c-4c76-aef4-4254bec89eaf", "sighting--588a319a-5956-4bfc-984a-a033f5991435", "sighting--e3452025-2d79-4263-9b8c-ea71b4503c1b", "sighting--fd2cff49-db99-41ed-bd1e-621278368924", "sighting--e135b479-5d67-4d0b-ae52-7e6dccc1ac81", "sighting--249ef196-2e9f-41c7-8f80-3dab8f0ffa48", "sighting--e7cec230-3dfb-4f48-9e27-c89a31ee3ed9", "sighting--d8eab22d-2e98-4ef4-b146-3d9a16aa9637", "sighting--ddcf7ff3-16c8-4c75-8197-0cd33084bb8b", "sighting--a390c41d-6568-4c06-801d-110ed3467548", "sighting--9bbb9065-783c-42e7-bee2-26e390a00e3a", "sighting--2ac7e27c-bd7e-46c9-80ef-871afe7a25b4", "sighting--0fb21af7-7ee5-43ce-bd77-2c4188fb23d5", "sighting--4a7a2a8c-50bd-49fd-8a56-de6f33bf5cfa", "sighting--2895fd40-7ae8-47fd-b01f-7bc0d22551cb", "sighting--8756867f-458d-49aa-b4e4-90f21ffa76ca", "sighting--5846feef-65f7-44a3-a39c-d4769bb99038", "sighting--7d1e3dbb-07f8-4eef-a018-c62926613b7b", "sighting--9f9cced2-25b5-45a5-b7d9-02d51397afbf", "sighting--f072b0a4-4b74-4b45-805a-539c795232b2", "sighting--d2daa1a4-32f3-413f-af24-776d8e5a3605", "sighting--d36b90f9-b282-4897-afd7-2b57837480b6", "sighting--87017cf1-29dd-4816-95f6-854d85f38113", "sighting--65becbb5-608e-41ae-9e9b-bca010b474cd", "sighting--2f4586c9-0f6b-4678-bd75-bd23cc1d257a", "sighting--0d0d4719-76ec-435d-91a7-743f775f4ff7", "sighting--77900fd0-66c0-4561-9a03-258041f90205", "sighting--b66e0756-6273-4012-8441-b32541583678", "sighting--110bc0ec-5682-4db3-b57d-45a219690946", "sighting--a0639608-1269-442a-ad3e-5677fcadcf97", "sighting--7284d000-6571-483e-95b6-fbe4e70feb46", "sighting--3cac3028-7367-40bc-a1e4-428ac4173281", "sighting--83808d39-4d19-4503-aae4-d13009f5de78", "sighting--accb5afa-d4f8-4df2-8aee-4672348c40bb", "sighting--a72d2b8f-a8eb-48a1-860d-ffd7d429e62b", "sighting--8e06583d-91a9-4f37-82da-2bfac4e91d61", "sighting--4a792a22-396b-4da1-aea3-721d1d7e1a3b", "sighting--82d8053c-25d5-4d6f-b3ca-d0d347fe56cc", "sighting--3b82cbef-7ccc-41f4-9a77-8b3ed727f968", "sighting--758fcc6d-d293-4cd5-b058-5643a28237e7", "sighting--fe66bae6-8421-418b-95d5-a60bf8da7a83", "sighting--ae9113e7-97ad-4f7e-af60-2a80938ea41a", "sighting--a88b4f7c-f34c-4ab7-84bf-3d13544157c3", "sighting--b37ffd3b-1428-4a15-8973-6850390c4648", "sighting--96029925-c9d7-425a-966e-fc6bc7f8c23d", "sighting--7ce22233-9854-4e2d-8c89-244f9236619b", "sighting--e0b99f78-a5b1-4b35-a584-cbfe4684025f", "sighting--6f19292c-e6ca-425d-88c8-4a1017dae544", "sighting--4e0cd28e-ed6b-4b50-976a-430fdd721d1f", "sighting--1072ac19-dbaf-4f13-b162-2af17d5e73f1", "sighting--30ccab10-6618-4e16-a24c-62c3a58685ff", "sighting--e89d0f48-58e8-48c1-bec0-ad27667ca098", "sighting--6f80a686-2044-44e1-9a10-8abc6d3b51e0", "sighting--bb95f88e-91bf-475f-9d08-c8b32cbaab80", "sighting--e6a8bc1b-48d3-4dd4-881d-b153b480bdd3", "sighting--5dd3d0ee-8932-4234-ae79-0ad1ad3bef20", "sighting--4fc13fdf-1d56-4036-a655-75a482c3e9ad", "sighting--40973022-3bd3-4e71-a4c1-07d1d34e8127", "sighting--e2c0340a-651b-42e1-af56-5d80a4eff6a3", "sighting--75dfecee-4be6-4780-8f63-bef97e043c3a", "sighting--7091c0fb-478b-4f71-8318-908bcc9ed90b", "sighting--1d0bfa2a-fb46-482a-8884-483d498d199e", "sighting--d68df92c-b2c1-4df1-aab0-a8e2819fbbed", "sighting--aa7d465b-a4ca-4850-aa33-31f999f85a67", "sighting--9d1b593b-9f77-465e-939b-e22743419b40", "sighting--c541c0d0-90ef-407e-85cc-01ff0f0cadea", "sighting--9ca08ed1-407a-4bc7-b392-04ee44a52c02", "sighting--8aabaae7-da26-4558-99ba-47ad3aa7fa43", "sighting--962c40ab-c1c9-4653-94f4-fec364ba74ad", "sighting--6198df6c-64de-4a3e-b553-aba7d919c092", "sighting--70603d27-972d-42df-953e-79c8d296a054", "sighting--88ae05eb-5dbb-492e-ab6e-1c414499093d", "sighting--eb37a057-785f-4171-8491-fc941b69b2e3", "sighting--0812a1bc-4aab-4bd7-a477-3204df545dcd", "sighting--92fa4e70-ecae-4f01-aebb-21ec205ec065", "sighting--fc2c0224-cd11-4029-a4d8-c4acac5ae113", "sighting--3ffdce27-be3e-4156-ba72-d17843b93ee5", "sighting--39172e52-ff7e-416b-88dd-495091f9c3b8", "sighting--983785f5-7338-4bc1-8ae0-f560de064693", "sighting--b650a910-6469-4172-b95b-9510c310e81a", "sighting--29c5cbb0-aebf-44ab-a0b4-e19c8148c379", "sighting--0bd67a59-80b2-4a33-b40e-fd437c553f4c", "sighting--3159461b-0ab3-491e-92e3-50265dbec2bf", "sighting--91107f0f-2a1e-4b0a-b025-3493f92203a6", "sighting--a4911ad2-fd83-4cab-b67f-dad6d06d784f", "sighting--87c98159-6714-4fe9-a132-e13d2363d370", "sighting--ba27e69b-9608-4dab-9a18-1f0f8a50feee", "sighting--f2eea5ba-4b2d-4dc4-8c2b-5b5cf0ee00fb", "sighting--abcc89cb-78da-4531-83da-36177314f9f6", "sighting--b27e6c8f-981a-457b-9ebd-b87f47b3accd", "sighting--05bfe537-d071-4c3a-915c-71b4342f29d1", "sighting--42df9f16-a4fa-43c1-983a-a00e20ea2e29", "sighting--95ed4d53-c51a-4ee4-bae2-f9240b5de18b", "sighting--b1554b5e-373b-43b5-82e2-4fd9676798d8", "sighting--6d7c840c-e75c-4bab-b3d7-6302ae6bc6bc", "sighting--5fb8b534-56dd-481c-9960-8cdff7d3ae41", "sighting--070cad50-a83c-42cc-b32f-d544bb466c5e", "sighting--c77c6223-3135-45da-b82e-d65fbe13d4c3", "sighting--04b1c0b4-7e3a-406c-88cc-162d2444fc0b", "sighting--defcf099-2df0-4c28-a10d-887c816c82f5", "sighting--20e1b074-b921-47ff-9a53-28c892123615", "sighting--1653a4b7-0fd2-4084-9f95-18d2675c64cd", "sighting--51403146-b0ee-467a-831b-5a4c291fe57f", "sighting--5a615aef-60c6-4072-b875-fbb197442e2f", "sighting--1d47c04c-0737-4aeb-9946-3c4ed4ffc11e", "sighting--da2c92a7-aa8f-4d84-863f-cb937972e7d6", "sighting--5ab9c2f1-69b5-4726-9b7a-b85a87a7deee", "sighting--1841fc8f-16f3-42be-a9de-0362dd047874", "sighting--1763cf04-355c-46a3-b25a-62f849a954ce", "sighting--30d89bdf-07de-42fa-bdfe-322088989261", "sighting--61c34a6a-8d1b-4610-ad29-188055979536", "sighting--31f96c54-8770-4911-aea8-a9e38f28487d", "sighting--721df250-cf8c-49d9-9f12-518b056d977d", "sighting--4b798e61-6f2d-4c85-96d3-37157b1745cc", "sighting--309f9e6b-a772-4865-87a1-5bcc37432eb9", "sighting--7205728f-ce9f-4937-a4f0-13931833a0c3", "sighting--ac9dd678-3a8c-4f71-896e-5b51c31bf25d", "sighting--f66bdc25-7504-4fbd-a04f-d64d9fdd0d9d", "sighting--105af46b-d56e-47d7-9bc6-d7a7e72f8f2c", "sighting--69796123-4b4e-4b94-91ab-f3dedc9c2dfa", "sighting--cdd34064-fdaa-4aac-b715-8954dbd9f3e2", "sighting--0ba42d7f-196a-43c2-ab86-154f14bb7079", "sighting--b8f1c9e9-9085-4a3a-a5fd-7be9e6ca1c39", "sighting--a3c64e14-c629-45f2-bdde-18c493441b9d", "sighting--4534d945-bb63-4b73-a661-6dac27a5d135", "sighting--8a96726e-0649-4687-8af9-9f3932480405", "sighting--e4394915-8e8d-4bde-a375-3b648af8b99a", "sighting--1ed4eb9b-8de7-4ee1-a560-5cdc1f0bacae", "sighting--3130eb3e-d82f-4370-a197-fdc1929e5dfb", "sighting--78be5906-7479-495d-9f9d-559c83883471", "sighting--6e3bd604-81be-4627-9e90-c38821d7bcfd", "sighting--1851f21c-8ec3-4ead-ad14-774f61aa4f72", "sighting--66e3dbc5-bd47-47b2-a71a-79a830543276", "sighting--eac975e0-fe07-41bd-b3f8-2bad52676046", "sighting--e614f990-223c-4695-a5ac-0517f1fe4781", "sighting--99096695-d4c1-49d0-908a-8e011d660cdb", "sighting--57756aca-4868-4765-baa3-2477fa945343", "sighting--a7965096-e768-400c-9128-5b601ee1b6f4", "sighting--86791eb7-7b84-469c-958a-258b415ed868", "sighting--fde90372-0862-4e96-9bff-e2d9168360b2", "sighting--8bbea6c7-3d0a-4683-8b1e-e57ee95ae64f", "sighting--32395bb3-9168-4a4e-ad2d-dd67d59a95eb", "sighting--dd256f5d-dcf3-4da8-a7b7-438592adfaf6", "sighting--33951c9c-8b98-4105-8c87-fee4f26dbeea", "sighting--722c7a80-1e03-456d-8c4d-d78c297d618e", "sighting--a1c451e5-a23a-4941-ad4f-5a8afa60945e", "sighting--22b91159-5cc0-4b02-aab6-f463221f34b3", "sighting--af1dce8f-1679-452b-a035-e6198c442b35", "sighting--309d3c92-a778-4d60-a681-40eef6ed2af0", "sighting--99cfda7d-ddfa-4c0d-8d42-26948f76bf75", "sighting--dbfdbbec-d8de-4136-b955-ef178ffec66c", "sighting--21467e8c-07b5-4228-b7df-fe1697cc47e0", "sighting--4838e017-56b2-46c4-8f0e-418b0eccbde8", "sighting--65f60ee9-d25c-49e3-9e1a-fe663e766ffb", "sighting--d9094a37-56e5-4883-b7a7-5af0c4df3bc7", "sighting--bf400c99-e0ef-4709-af0a-4079efda7aba", "sighting--d9cab7ce-2565-4af8-a69d-37afee7c6fcb", "sighting--d258e291-68bd-40a6-9e6a-89dd3cda3c54", "sighting--3b74321d-8b89-4e7a-a1fd-d81f4a49d2bc", "sighting--6ce59822-8d44-4fd5-a401-2da614aa1a0d", "sighting--7e65eeee-6948-481a-b12c-b61cdf4865c8", "sighting--374258c9-94fa-40e3-896a-1e79239acfe8", "sighting--b13549cb-ae2b-4f0b-b076-a57fa96718f2", "sighting--bdee906a-91ce-463e-9562-5b946886f3d7", "sighting--22af5bd3-d257-4309-8356-c882a4356fd9", "sighting--6069acd4-dada-4660-b498-e59c620ce8fc", "sighting--ce658f0c-f8a0-4d51-aeaf-088bdffd58d7", "sighting--4971c91d-ccfb-4547-b2e8-63008fcdf08e", "sighting--e733b521-20f8-424f-a60c-23c7ef9e7dcf", "sighting--cfc388b3-1ea2-4b52-8894-61909691ae7c", "sighting--55823c07-b7a7-4dbf-bec5-453fb920cc02", "sighting--0046dd46-955e-441e-8ccb-3885ddf1e303", "sighting--69814eb2-33a3-451c-ba1a-fb715c837eb5", "sighting--1851db39-fa7d-4875-890b-329d5d79a2c1", "sighting--e7258a7a-bef3-42b9-adeb-0b8765b4895b", "sighting--18893762-cb73-43b0-a1c1-6e2ceb5b38b8", "sighting--aee7c484-2446-44bf-98e2-d3c59fc1c512", "sighting--03e79341-76a3-48a5-abe6-6e3b618bebe2", "sighting--f49930bf-3c6a-46ec-b694-60b06ba183f1", "sighting--2aa16502-f73d-4ab0-895d-929456ce2a1c", "sighting--09ab53e2-16c4-42a4-8a29-7e1242951209", "sighting--b7602956-8487-45ba-a929-1d79d956f776", "sighting--e1a1f9db-4ccc-472f-aad9-95dcfb45f3d9", "sighting--963a2948-92de-40c3-97e4-efc1ea4e785e", "sighting--57c6dcde-1eb7-46cb-8027-7bdf6d762445", "sighting--e829054e-0574-4083-bcb5-bd053a6b0936", "sighting--77e2d16d-df9b-477f-b97a-effcd7c8f450", "sighting--c34b1980-fff1-4d32-b5eb-4d9a5b9192f8", "sighting--217992e0-0b7b-49fb-b072-7092bac2b227", "sighting--6ea692a8-40e7-48d7-ae50-302d52a69067", "sighting--01a2a93c-92ee-4aa6-9638-6f6c826e56d6", "sighting--b96f6cf4-bdf0-46f7-b51d-2666bfa3b9fa", "sighting--c9789e41-6ed6-4305-8a95-9d8b36b1ecfd", "sighting--1edcbcc0-86c2-4a3d-a39f-3af0a2adb85f", "sighting--862301eb-19c3-41e8-bda6-00a4dc2c1262", "sighting--94eb262e-53dd-480c-be78-fc326b789e7c", "sighting--cd5b4ad3-36a1-44a9-9c04-c431a8ce6db6", "sighting--f0a9d1cc-05a4-4362-802f-5016526e9ede", "sighting--9ce1fc74-e48b-4717-88b6-3e0f517c7f1c", "sighting--460cdc6e-8cf0-4d82-832b-5ca9e11cfcb6", "sighting--b343c14a-0244-43d7-b4bb-7a0906141dd5", "sighting--1033a7ac-fce8-41a0-8ee0-04c15964ed1d", "sighting--bc75cb82-8ef4-431c-8254-ed3ab8bf19ac", "sighting--7d35b6f6-f856-42ed-921f-781e60dcea09", "sighting--754a0334-c16a-4aaa-8b42-3aa31913c5d8", "sighting--5793c0ec-aabb-4360-ab3b-6c3b78fe3ffb", "sighting--90189e93-06d8-46ef-a934-415878f32b1b", "sighting--36fa0988-e7ba-4c02-91f7-6ee957f77871", "sighting--f912bd96-3965-41e3-be34-d6a4032516ee", "sighting--fa14f6f7-6af3-4ea7-82ad-395e2102c113", "sighting--05168031-e82c-433a-b2c0-f0e9b50762ba", "sighting--52307121-83ae-49ee-b429-ff8ad172544d", "sighting--a4654d40-ca68-429f-80d9-fa761c227be8", "sighting--042399dd-7826-4e11-aa7f-e10e6e92ca38", "sighting--086b0481-d103-4de1-8c84-a8c2e3a9811f", "sighting--7b4e0381-e23e-4107-8b8b-d79c300c8199", "sighting--3a03cdb7-6ddd-4eac-a0da-0736a54794dd", "sighting--c1770c3a-707e-48b1-bc2e-0eb4f5748896", "sighting--cdcece9e-2fe4-4b66-a0e3-29c4704dd3ae", "sighting--ff94fa45-1150-4a25-a6e4-1f95745b8781", "sighting--d7502f87-7dbd-470a-82e8-a0ec8e255b53", "sighting--e4638a60-9d94-41f1-8311-60ac3650969c", "sighting--d508429e-c91c-4f28-a724-9ed439b878bd", "sighting--a5ddc22a-b25e-46e6-b53c-86cffb9852f0", "sighting--7e3c01c4-f784-4fe0-9b18-ab50cc404088", "sighting--7e2d5caf-17af-45a6-a3d6-07aafd07f4aa", "sighting--4a597872-632b-4c2d-ac05-23943092838f", "sighting--0303b887-9193-4e43-a98d-dcd7bfb5ac38", "sighting--abd9ef34-2dac-4118-9589-6f7262c691d2", "sighting--9044c757-d614-4f60-8b55-6b6341cdeece", "sighting--5516a692-ca8d-4781-8874-58ea02e5b04f", "sighting--d89b1530-9232-4681-9f53-0f53f6cdb44b", "sighting--4d4466c1-2c91-4ea7-b14e-774eb68872aa", "sighting--0f4a8377-e966-4be4-a13a-5549f6a0f5cf", "sighting--e3665406-a775-48d1-b4e2-a5eb3302598a", "sighting--78c28ee0-82b5-46af-868d-be99d5e74014", "sighting--3bd54046-f587-46bd-a1ea-599b9d3ae0c1", "sighting--309f53c7-573a-40aa-9db3-fdd0193f2c92", "sighting--6c7098b2-ebad-4a1b-a7e8-8ac64ad0506b", "sighting--c81640c6-b54d-4334-93d3-4447b75bf995", "sighting--0f62f33e-c8c1-4366-888f-97dca2c66793", "sighting--eb034014-496a-459f-922b-96a977443528", "sighting--a87fd0d7-49fa-428a-86e5-9c2090b07287", "sighting--c7a573be-d44c-4856-ae9f-b71dff479d50", "sighting--11f150da-d81b-42c6-9069-d0be1a5e6844", "sighting--ed830ff6-378a-43fa-b2a5-6f694d9e9c44", "sighting--e82de7e7-5559-4155-99f9-c313e0c7523e", "sighting--e09138f5-68f5-4e72-8c7b-b76b70431d44", "sighting--067d0301-908e-42dc-84f3-c290a0bbd9bd", "sighting--73ddeb09-73c4-4221-8e02-caea9da60e47", "sighting--d5127405-a774-44d7-84b7-3e9c359a092d", "sighting--24ea4ed6-88db-4319-8fd6-d068b2110fb4", "sighting--3130d640-2c0a-4b73-bff4-e43a69bc27bd", "sighting--b59ffa2a-7f4f-4088-822c-e089abaef560", "sighting--5c7d0e2e-cfaf-4f59-aa6a-cdba0703ea3a", "sighting--a976ad3c-f5a0-4580-a601-defd2b33d6c1", "sighting--193f18c9-e241-4626-a285-ce58b1149447", "sighting--664868db-b28c-43ad-941f-f126f73bdbd4", "sighting--5c6ad802-97fb-4848-8f58-ed0f2d451e9d", "sighting--aa7f3d7d-2e54-43ae-a895-e3e41fdf8e0d", "sighting--2e6297c2-e2af-4d09-be32-b0a2912f1e57", "sighting--5a0c1e79-55c4-493d-92a6-3420e42a30d5", "sighting--b926329c-a420-4db2-9ba3-9b554894d362", "sighting--c81f3494-1d91-4251-bc2e-13bd3ca877f7", "sighting--1e4f7ada-1842-4f4c-b7b4-4f8ced3e6407", "sighting--a36aa45b-b117-4179-abba-6d926f352533", "sighting--004fbebf-278b-4445-ac8c-d39b6e0effd8", "sighting--3c0474ca-bd19-43ec-9cfa-4a7294d16b5f", "sighting--c6ea38ca-a7fc-4ecf-9b1e-3407ebbdae37", "sighting--18d93038-c235-4191-9136-5e5b54a933c6", "sighting--354a2184-ab2d-46a2-889c-7ed5308a5ba3", "sighting--8a8f0c21-23c0-4eb9-bc6f-c5c3174a7cc3", "sighting--337c21ce-170f-4332-a204-251f539268c0", "sighting--23063d3c-a18d-46c1-bb80-82ea7e8ebd63", "sighting--aba60ac3-05b1-4fd5-b79c-22eca22b309f", "sighting--f65947ac-4f41-4e4a-b192-56a7e58b7eac", "sighting--33313e2b-26d5-4c82-92f9-7f96ba2ffb0d", "sighting--b6c36720-53e6-496d-a8fc-2baf8fbf8e11", "sighting--b686e0c8-ce8c-4f54-99e0-47e36446ca45", "sighting--479a781c-524e-49f8-b429-79d5a4af9c22", "sighting--c5057a5f-4e9f-4483-8a64-76d637b0fbcc", "sighting--34fe1817-5f67-4f1a-a261-18924cb494e7", "sighting--b3211e1f-adfc-489f-99d1-9e0f6199aa14", "sighting--92cae7ce-e68a-4eaa-900c-8bea108a41df", "sighting--6be29370-08a9-43ca-a9dc-3f9b16be4090", "sighting--1de2aca0-f2d2-4050-8a25-0b68637bfa4f", "sighting--08393877-c9d9-4284-909d-bdca7d52df05", "sighting--1e147fbf-54f6-4788-9aec-f7ba10eb14bc", "sighting--1058fc5c-e3dd-41ba-8b44-2abe05b27b67", "sighting--2db3c509-b0f4-4bca-9232-5dde9a15e2b8", "sighting--0a9260fc-f6b3-416d-8c32-d7371271ebb6", "sighting--0971111b-90f6-433d-b3e9-b66a7d7cf074", "sighting--f5aa40a8-1d9d-4000-b70c-cc064e25e682", "sighting--d0694912-2bcd-4096-82fe-e426f189c4c1", "sighting--8fcad79b-87e7-4813-b2fc-ca2c5c856ced", "sighting--2dc5c6c3-7f2f-4bd6-8e8b-78de3323368c", "sighting--6dfe50e2-3717-46e2-898d-060a4acb7cf1", "sighting--bf314354-2fa9-4ada-bb84-5b3844807e24", "sighting--32cb677c-2607-412e-a5b3-17fe25a396af", "sighting--ac88837c-a275-4232-9539-d8d71ec9a717", "sighting--7ed88ea8-2190-4ed8-a7ad-3e958c0f2fcb", "sighting--966ab913-8897-4adb-8a44-11839abe0a58", "sighting--9e7a93ad-70b2-492e-8051-58371d01e65e", "sighting--3a52b7d9-be49-45af-a217-9cccd73a75ab", "sighting--e19af980-d18e-466b-8bb0-b475ea37925f", "sighting--e8177f97-8202-49e5-9e2b-225f09868f7f", "sighting--9d7f5fd0-b298-4292-88f9-e7145a1f6873", "sighting--37e1bae6-f1ea-43a6-bfea-5880066f3e12", "sighting--dfe72fb5-86c8-472c-830b-71a096bf5c6d", "sighting--a88b032d-6dfe-41c1-91ea-d24073035004", "sighting--b247851e-0194-485d-b998-4437d3d77df3", "sighting--5a2c8f45-7add-4c9d-82c6-a72d40455af1", "sighting--b176feee-d740-4230-9570-cac1dc7025a9", "sighting--2139cfe4-4895-4f2a-8ee1-be03903ca46e", "sighting--14e87f83-5c4a-4d5e-9894-db3cc859f2c1", "sighting--7472a6d4-69ab-495f-8944-e11d48426446", "sighting--a8b615ca-18b0-43fe-9b34-1e8ada53491c", "sighting--483a6a8e-cb8b-468c-a762-ff3feead011b", "sighting--29f70eed-01bb-495c-973b-81084eabc67d", "sighting--32f988f1-81e2-497d-9590-cb383efeff3a", "sighting--7346b100-5697-4695-9b9b-5f80806407a3", "sighting--fcbb0fcb-199c-4a86-aec1-7bb927588128", "sighting--13cb121c-433a-4a07-914d-abc5e747f142", "sighting--a3e84fc3-e0b4-488a-a83b-3fce00d0a639", "sighting--51e8c89e-b96c-4c2d-b1d5-ad87aa86845e", "sighting--f5ce9808-7b9f-4ace-89a9-466448e3fce0", "sighting--cdee768f-5ebe-4523-b380-33ee49b1cea3", "sighting--b30ed5b5-71d6-4a45-a84e-081ce4bdd2cf", "sighting--d9f66d77-86eb-48dd-bd91-79a8b962bc7f", "sighting--3c9fbe16-f28c-4473-9660-13f544386cfc", "sighting--ee6b1b87-4ad5-4820-8435-405430cb9412", "sighting--17fc8cac-4a9e-4e54-9d9a-17c454ee03f9", "sighting--0e15534b-9bd9-489d-88e8-f88f68c17066", "sighting--86aac348-db7c-4aba-847d-79f87f5d0ee6", "sighting--267bd7c6-3b80-40b9-bb49-f95b8e8da090", "sighting--2d38db3e-e0ca-4db1-b53a-222680f8fa55", "sighting--06e79b34-6867-429f-995c-06011cbeb3ac", "sighting--027963ed-1070-4cc6-97e2-556c2fad4ed4", "sighting--b23c3b47-7870-4533-ba7e-1c5899446904", "sighting--2511ebf0-9c01-463e-993e-c36354abf678", "sighting--92139837-7012-43bb-bb4d-e59065f4de37", "sighting--f40bdf03-5e3e-4db7-8a00-9eefe20b7e24", "sighting--08c9f419-9dda-4c20-b05b-377a9eb0a06b", "sighting--724637fd-0d5e-48b5-bbae-d681876f0b39", "sighting--0bbd00fd-d892-41e2-b844-b02144e61765", "sighting--46af5012-fd84-4bbf-8ca3-355406c170dd", "sighting--f3598d0d-dcd3-4bdd-9861-1ab53f2affdb", "sighting--c0993391-4493-436c-bba3-85a743255fc4", "sighting--489db288-1806-4c87-8513-2467b29ab663", "sighting--ba481208-5f45-4c85-bba3-84c9b4e8fca7", "sighting--e2ee7faf-051d-4e67-8f3e-ca390ec132f3", "sighting--1e02a5bc-ff56-411c-83a9-35146b215421", "sighting--cc2eaa6e-03eb-451b-b915-bd08674487a2", "sighting--31b344d2-cc0a-478e-9a27-421a1859f872", "sighting--7886346f-8bf6-45ab-819c-848207ba3796", "sighting--81c4adc6-0c57-48ad-baaa-377c77f67a85", "sighting--abad05bd-08e6-47b1-9039-8e2982dc7801", "sighting--e5c68445-c042-40a9-91c5-d8ebbb899a5c", "sighting--2c5abab1-23fd-4062-98d8-9ed626fbe44f", "sighting--43c76931-0484-466d-bd76-f08cfa3e0759", "sighting--bc1259b0-1500-4b02-b3c0-c6192ac2cc31", "sighting--d4f4fa9f-f412-4ce6-af86-6d1043a7f1f7", "sighting--88c81c80-0a4d-4a96-936c-91d43cd0711e", "sighting--778a9e25-83d9-4393-9e18-2e43aba9dbd6", "sighting--557aceb5-1eea-425e-84be-4be74a57cbbe", "sighting--c17a7bd3-0180-4713-917e-3ddfdb5295af", "sighting--63e885ef-b392-4517-8c8b-61a5ba5fcebe", "sighting--4613c498-9ee9-4d62-9844-dd3998fe1988", "sighting--812e8b84-2110-4181-91b0-4abcecf8356d", "sighting--5db9b7a4-c2e5-4ca0-bc04-b63420de94a5", "sighting--2ea9860e-e7c1-4dfb-a5f2-34b3d8ae53ae", "sighting--667aafae-abdd-49e8-a5d5-1f9bda5a8a2e", "sighting--5970aee1-d7f4-4aea-9971-a309bb0fa84e", "sighting--ff11f05d-d190-4816-8080-712e1e7e2669", "sighting--8cf5a389-77bb-486e-a415-9bda92099a83", "sighting--c3f8f75f-1520-4874-9391-0b809d197bbb", "sighting--115af88b-fccd-4a01-bfd1-777bc39217c8", "sighting--c13126fd-7ac8-429b-97ff-ba3351765d68", "sighting--e64697da-b6d8-416e-863f-1b4156bcf977", "sighting--426d4887-b390-4a2e-832c-0bcbd9ca09bd", "sighting--df5237c6-73f1-4418-ad96-e7489644d823", "sighting--78eef616-7cbc-4818-aca5-0aafba4263c8", "sighting--bd09b86a-78cf-401f-b46a-5005ee7a3dc7", "sighting--e5502aab-0872-4b37-b0ed-3fecefe2c2f4", "sighting--b1410c90-d13e-49ee-a307-caa72ddb9940", "sighting--5181b216-588d-41e4-85ec-17a74705138c", "sighting--776b22fe-7ff5-49a4-92c5-4b30cf016bdf", "sighting--65ef0b35-af1c-4052-81ab-9861f2e93cc9", "sighting--e226b3e6-9db9-441a-b458-bd3b14f0506c", "sighting--4441565e-e411-4d1c-9a23-e4bbb1e9ba2f", "sighting--8f0af425-f992-4e4e-b67a-6849fb0e3326", "sighting--7b6f0db6-f0be-4c8f-8114-6d4345955e8a", "sighting--f909a40e-518a-4795-96f2-2b116dd989dd", "sighting--6b57a172-d6aa-488c-9a97-aed2972b7ca5", "sighting--891e31ce-6b69-47b7-90b9-7906baf97234", "sighting--cca0fee1-3b24-4bbe-95c7-a734b5ceb85c", "sighting--d46d7a7b-7cc3-419d-8ed8-85daef2b9f0e", "sighting--d089c5f6-be8c-421a-b065-635ff3abc6bc", "sighting--31ebe829-4bea-47e0-9cdf-12227dd3f564", "sighting--bc7f8eb9-d1b2-452d-b229-35686e64dbc3", "sighting--479f1d41-9cf9-428a-be63-cf33fe38cad2", "sighting--7bd943d3-b9a7-420a-9a83-f77918e86071", "sighting--1d915006-b733-4419-9405-9097e385dce6", "sighting--7844e178-6bf8-4d6d-bbf8-3925e71213dd", "sighting--9bf83fa7-a44e-4772-88eb-a36ccbcdfe97", "sighting--a09ae90c-e634-40ca-b2d3-b4abba79b26d", "sighting--cdc3a6e7-7e86-40a3-9e6f-4435cc9a4004", "sighting--6b80b32e-2b3c-4fec-942d-7b321a10c798", "sighting--63ee4dd1-efce-4788-8b29-fbc2a1f3aec3", "sighting--3831139c-a7be-40d7-a77d-bdc8fe1874fc", "sighting--7701039e-ca38-484b-81b6-c018b02acfb3", "sighting--a20fc2b4-b9e9-485a-802d-5a0368247be7", "sighting--3e72c512-8254-4ad2-8c09-03846afc7ea1", "sighting--73c82fff-3488-4f62-8309-607d27009fa2", "sighting--630ef67f-e96d-4451-aa96-3764d72d5766", "sighting--afcbc44f-f013-42ab-821a-c19818d9c468", "sighting--6d1d5d9a-adf3-4175-9cdc-0262e2bf3fa8", "sighting--b9085b0f-43bc-4b03-962f-c04956606a63", "sighting--48db8120-4e04-41c1-80e2-90e04be12849", "sighting--ff6358e7-b956-4ed3-96d7-7941fd2c3bee", "sighting--6bbc8b56-6669-4c1d-b538-5c2acee2afd7", "sighting--d2d419d6-96c6-445e-aefb-632ef19c3f60", "sighting--ed99b8de-1934-41ba-9155-c8a3e8fb2e2e", "sighting--3a8672a9-bf2e-4cba-b972-b0479a9a1ef7", "sighting--8ba17d9e-017e-4535-9d3e-d739ada0a394", "sighting--f0b9bde7-b309-4caf-bca8-d0e3adc566bd", "sighting--e3638516-8604-428d-a850-9e986b343623", "sighting--84c1f355-702a-4076-b122-8951216d930f", "sighting--8032ce85-6144-4efb-b898-80bb9c7284c6", "sighting--3def8c33-fc06-4096-99e4-aa3c2e9e14d3", "sighting--3853f56e-9898-4007-b823-075ef600406b", "sighting--c3d1e543-6099-4ed1-a374-20f8821ac607", "sighting--e128720e-5240-4e0e-9d01-288eecfa38f4", "sighting--c6fd6d74-f59c-44ff-8b06-417fed000f3d", "sighting--2437d6ad-ebff-4239-8c1b-9ed667bf41bb", "sighting--80b14256-16ef-4703-8407-93660b892162", "sighting--1f8ed727-9631-439c-90cb-501ded0692e0", "sighting--23dec1eb-4442-4c9b-99a1-5d340d2b457b", "sighting--5d99a04f-7b2f-4aaa-9587-bfc2360d4dd1", "sighting--8d394b4a-2ecd-4e9d-9905-390e26e8bcc0", "sighting--7af86c6d-0f67-4ca5-959a-552da80204a5", "sighting--ae75946e-fce1-4478-9540-20bf39e3ebf9", "sighting--21ec9559-260c-494a-9a05-1abc6c13f8ff", "sighting--bdb82fc3-8261-43c6-9e50-b989edc01000", "sighting--e0617db8-5e74-465f-a34d-d7c411f65fb7", "sighting--d497fcb6-7b03-46e9-b28a-fd6c187b181e", "sighting--e2f0c990-7c18-4928-8699-6e35c20adb8d", "sighting--be1d22cc-9b31-48b5-b111-2d3f5acedce2", "sighting--57d83b39-888d-44ba-b743-cb0634963d21", "sighting--e924bfda-d197-4a02-a171-970c9b0ec882", "sighting--6c33d912-2d85-49ff-8707-94fda78ea1ef", "sighting--5062c1e7-12da-43b2-bb7e-98a5b74c9779", "sighting--0f5a93ec-9227-4a85-879b-27e1054a5265", "sighting--61f502d0-b130-4b02-95b5-4854975af0a9", "sighting--a0640396-5e83-4e53-bb9d-0f028d2602ff", "sighting--816f35eb-1a74-405d-9e74-f8e921cb593f", "sighting--b240d0ad-b800-4bd0-b86d-bcbfa266fb03", "sighting--a5be0e7a-923c-4fc1-8fcd-ab2dabea8f81", "sighting--db85ad02-1f88-4855-bd18-e2b87bf5bc4d", "sighting--a6e8cf81-2a7e-4870-a424-da2993f3bbcc", "sighting--67a9e9aa-6cc1-48f5-ab8e-faf5b73976f3", "sighting--81d92174-d815-4cf3-b564-1c9628781419", "sighting--fb312014-e115-418d-a795-b24f1be812c2", "sighting--35acc525-6781-47fb-a105-7519cc7e149f", "sighting--f4951bd9-cbde-45f8-8742-b73611ac7433", "sighting--eecc285b-ab40-4da3-b228-cf1fa79f791b", "sighting--e57a3e92-1f91-4471-9189-1288bde00f37", "sighting--fefbeaea-6c18-4e62-9256-fedcd1379f21", "sighting--68e60087-b522-4458-8716-c4aa68421b46", "sighting--641ff7cd-a616-4367-8a58-2b882cdc4e29", "sighting--ee18ef9b-94fe-4980-ad29-458ca082e650", "sighting--7d76e0f6-b43a-425b-9887-b07da66d37b4", "sighting--2bcb2bd7-f24b-4e6d-bf2a-0266070348cd", "sighting--99b5100c-1cfd-4a9e-b8e6-f7932ebb53d1", "sighting--3e34a31c-0876-4da6-a6b4-aff09121869c", "sighting--432063d6-fb8d-4e29-a26e-e6041e30f2da", "sighting--12cbb956-232c-44ac-9cf9-f3af92af997f", "sighting--b2039658-80e7-4142-86ac-cdd7cb5ca5cf", "sighting--b88bd0fa-4450-4e57-9a03-c6d2ebd79c06", "sighting--b312af59-2e9d-45e8-bbb8-062421593dc0", "sighting--2f96656d-af34-448f-b32c-f39ae01884c2", "sighting--37caacf7-baf6-4e91-9f5a-884de8ec09d4", "sighting--84a7fa5f-4a64-4e0c-bebe-7c8d2ecc16df", "sighting--9e8c675d-5083-4221-9012-c797678dd566", "sighting--642a523b-2c48-4107-aaac-d1c01a4e9846", "sighting--c8fc78c5-fd7b-4237-ba07-eae2ebbd975e", "sighting--8f32fb6f-7c4a-464e-b961-2846b5c02561", "sighting--b979d21e-e032-4ccb-a027-d9d0756bf86e", "sighting--6f3963c2-7776-4257-8a05-d5c95c30e64e", "sighting--61bd26e4-36d5-4880-b316-e627ad1e0bda", "sighting--b678d827-0da5-4ecb-b4f3-77df8bf37ec5", "sighting--92eefd66-6e20-496e-bbfa-895bd9a7ecd1", "sighting--32ef8176-d9ec-446b-a853-6447d70b0361", "sighting--fbe49859-d8db-4b41-ba77-1c6854280265", "sighting--6123d677-2e8a-4541-ac86-6b1a65036949", "sighting--0721e303-eac5-4566-bbeb-d843dab64968", "sighting--62732b14-958a-4b7b-a6ef-7ac1e356a945", "sighting--56d3ae85-8f81-454d-863e-b5d0f7ada652", "sighting--73164d87-ca07-4158-9eea-88dad06d3264", "sighting--bf1a2914-9eb5-42d4-bd1c-9feb7d09cf68", "sighting--90a31d66-4537-4cae-ae87-b3fe1b443978", "sighting--b84fc659-fb27-49f2-90ea-b529b6f56518", "sighting--14a17dfc-d95b-4ead-87c5-f10dbe113d83", "sighting--0cdabab1-b646-4c9b-a8d4-14edfb6165c2", "sighting--6eb580d1-60ad-4d4a-b3f9-1f96d26fa39f", "sighting--c4bd239a-40ae-44c0-a6fa-8d62e41da496", "sighting--c1424b28-67dd-416f-990f-e72b347f12d4", "sighting--359d2ab0-bb3e-4c9d-b630-9f6994ff40cf", "sighting--d48da812-b6b8-46b5-b35a-1e154dd95603", "sighting--daaf95ea-e1be-45fc-9b03-56d9ab225c64", "sighting--c0c1d0ac-9853-48f2-b3ee-184f333c0259", "sighting--c810567f-e311-421e-a935-00c311b91ce8", "sighting--0ea2a37c-0eb6-4b23-9209-a522036f965f", "sighting--43fc646d-c24b-4d43-b7b7-1d62000e2703", "sighting--3ddcd579-ea50-4c31-9d8c-452e8bcd65d0", "sighting--ba1a2ac2-d8a3-46fd-8b3a-efcaa2644044", "sighting--849c9bc7-c6a6-4a2c-b32a-615e5f344f98", "sighting--52a97625-1fa0-4522-870a-985001211c8f", "sighting--739a5e7f-1b0f-42ed-9cdf-802162634f49", "sighting--5f1edc41-4c0b-43d6-883a-a9c372b22a61", "sighting--538bdbdb-181b-44c4-9235-8936ee154eff", "sighting--e990ce9f-b0d2-4123-a391-032875d65476", "sighting--f02f4ccc-c126-4fa6-819d-01dc2d1a55f4", "sighting--4c4607d5-e612-43a4-a242-599c653f104b", "sighting--a2a31919-24a0-4ab4-9871-59684e6c9d8c", "sighting--5b2b1803-a2fa-46a2-808a-0196b47ad72d", "sighting--43e7a4a0-e1e2-4354-8831-d652924b4348", "sighting--a565ab99-5781-4213-8f93-2eaf90b40a70", "sighting--542c623d-321c-4f34-a2c2-cc0d4eec22ed", "sighting--ec23e95a-a600-42e2-bd3c-00fabb3753a3", "sighting--be14d331-4c51-4ba6-ba27-3060250b7fcc", "sighting--f296e184-75ae-419d-bdae-41627c530ef2", "sighting--1b8718ab-261d-4b53-8972-5860b24bef91", "sighting--d265feb0-ae09-47ad-bbd1-1a1536a670d7", "sighting--ea26c2e6-8d2d-4046-919d-7d407375ee01", "sighting--61917b28-a0a6-4811-b31b-42005219d751", "sighting--51505fa1-81c5-4d8f-a912-6dfcd3c3506e", "sighting--9c337e05-00f9-48c2-a81b-fd208b6102db", "sighting--1f323b81-900e-4305-9b88-32f5c31069ab", "sighting--d2386833-e668-4788-a846-bca86eda2e8c", "sighting--38c05f9f-6456-48f6-9d82-30b10f3191e3", "sighting--6f9ee5c3-6adb-471d-bec7-d856f63c6b8c", "sighting--42bc1f08-fea3-4876-a6fb-b66b2ae3d695", "sighting--3379d19a-6848-419f-b0b9-008563e5308b", "sighting--93490aca-eb3d-405b-beca-f9579ad41e64", "sighting--5b29aad5-52ec-44aa-bde6-899a2609eced", "sighting--59006b0e-00f1-4b23-9920-63e6197b269b", "sighting--95922935-d257-4dd6-aa02-573768b734b4", "sighting--473dcb9a-eb9c-4b59-a880-7a2533bb632c", "sighting--9d0163ea-b3d2-4a79-9a83-19bba40ddd69", "sighting--70569ccf-8171-450c-843f-3d6223ba13f5", "sighting--09e06850-9a82-472e-b1ea-d8166d45a045", "sighting--33e6b4d0-9f89-4799-b4ef-f5465a3a036a", "sighting--d4bdf282-fb74-4989-9e86-b74628bf4b8c", "sighting--fb143b39-409e-4f0a-bc56-0cd83cef0bb8", "sighting--691bfd91-2ebd-4e4f-9f0b-269378337e97", "sighting--ab30dc01-e3f1-4aef-b18d-fc455c200bdd", "sighting--316d9405-036d-4db8-b9d4-e6a7820bde66", "sighting--c273d65b-15ce-4c34-aa28-ba9ad8889129", "sighting--5fb410b9-90b8-4422-9f93-74ca80a36b8f", "sighting--1fe18e7a-a1d5-47dd-8d07-a4dccb05d78b", "sighting--8a9627e7-340d-4ca6-a405-fa1203b97aa9", "sighting--9bf27afa-fe19-44db-aaff-068d82370591", "sighting--a1d91e37-07a3-49ea-b106-303ccd6943cb", "sighting--69bf58da-9f79-4cc4-a9a2-a6ec042190c7", "sighting--a4376e3a-76d0-42d1-a990-af9c23270c93", "sighting--847ec6ac-4411-430a-b0f4-9ef190099c0f", "sighting--0e52dafb-d64e-447c-a327-1b1c19d6c994", "sighting--679da6b6-1580-4e24-b25c-a7d044eaffe6", "sighting--ae67590d-edea-4f58-b78f-9507e8c2c339", "sighting--4617e05f-7983-4a82-9614-d83e7fc061d5", "sighting--fe4a8b2c-0817-4b42-94dd-b00ede4985c3", "sighting--b7709ba8-15f3-4c76-a699-6006cf8a391e", "sighting--676baf60-721b-438c-af2b-236b43fbaf9b", "sighting--c31b2c28-5b7f-43bb-b76f-abaf565ac2a2", "sighting--3fdb4906-44f9-49cc-aede-9bcd79e91935", "sighting--bb3ef5c4-890a-4c43-bc13-e739cf1831cd", "sighting--3b918a98-a6df-43eb-b87b-877e3da5e284", "sighting--55f10ae4-d2c2-49ac-b8b6-39a317baed1c", "sighting--acf65e5f-f5fb-463a-ad16-707924e6bd2b", "sighting--6e31729e-c2f3-46ea-8b2e-c53e0351dc47", "sighting--fd7562f2-fb8e-4eed-8722-4ed110ace584", "sighting--ad868f5e-cd9b-4d62-8aa9-ab21cb344a2d", "sighting--dcc8cd68-cbc5-4969-bbfb-dba718f89b88", "sighting--e66fdc3f-e93a-4cdb-b459-4343198613d9", "sighting--3bc1da10-f809-4e5f-aa1a-eea93b536ab2", "sighting--56dbcad9-2a3a-4c0c-a7af-5e6f0b24dc83", "sighting--7a5c52a4-a4e1-4b03-a7f1-2c036515c143", "sighting--fa60fd72-1266-4eb2-8bdd-71e20d4637ab", "sighting--31b1c5cc-56d8-41fe-a10b-ff78b8066cca", "sighting--a5fd7768-26af-4297-b2fd-bd773ecdae01", "sighting--f224c235-9ede-45d5-bfe0-4bcf724871bc", "sighting--ef36a73c-f17e-4628-a02c-db0a377b1697", "sighting--bf056bde-8343-46aa-a2cb-8bf35aff9513", "sighting--7ba3ad2d-af9c-440b-b172-8fccc6ed229a", "sighting--2e3a9e57-8a8e-4485-8d39-18452d669324", "sighting--f36439a2-65dc-4056-b94f-222bce57816b", "sighting--0df38f5e-f4e4-4a41-8396-debfec003547", "sighting--5f7765a0-1a16-4a62-b858-d429762ff272", "sighting--93a5dac2-e678-4fb0-9ac1-b618fa71a55f", "sighting--a31ab61c-c312-418a-948b-5979b54eaaaa", "sighting--aeb4f475-eaae-44a5-83a0-f43c6294f234", "sighting--bc002702-9f23-4cd7-91d9-c29320b264b7", "sighting--e289308c-5bbb-485c-bae3-2a600371e569", "sighting--2ebf7f16-8923-4093-8634-ed1dfc8a2571", "sighting--7637ea7f-db77-4dcc-b5a4-0d287dddee3c", "sighting--9ae64276-02f7-4b1a-acdc-5ad591774ccb", "sighting--1bce2e71-3cb6-493a-8bcc-c8c32a334e9b", "sighting--36a9439f-aa8d-4135-bb6f-ef97333ad824", "sighting--16e41060-2eb5-416f-a183-6d75b8c351e3", "sighting--46358931-9ddc-459b-86ba-7942a83e20d0", "sighting--afec41bb-e9ac-426e-8b7b-0dd241beaea1", "sighting--dfcb335f-9f28-4a27-8e0c-af35c0f340a2", "sighting--c3d26dce-3254-46d9-9aa0-f294c884ac8f", "sighting--db3c145a-8514-4813-aaa5-666d3f0b74b2", "sighting--f6afb5e7-6a4a-4790-bf5c-c10ab8d434d5", "sighting--d2477113-996b-4015-9872-0817a0315480", "sighting--191b4991-018a-40fe-aa41-f043c147aec7", "sighting--83824304-8830-4d31-b4d1-e38f63272269", "sighting--5dd261c3-74c9-4f22-b26a-411e8585a512", "sighting--cd182da6-3417-49c5-94d9-ada68f1851a7", "sighting--bcc0c8d8-497a-4e22-983c-27b797ca7d38", "sighting--b944dfeb-c58a-440d-9575-4aa07c64d419", "sighting--33e97962-7c6f-4f6b-86a4-7fddd5edb123", "sighting--44a9520c-8c57-4636-8d99-38895ad4414b", "sighting--ac74d9ea-2141-4823-96d1-298e83c0a78b", "sighting--d6e2fb64-5653-4a95-afc0-282bc4053748", "sighting--1376c32f-d933-4528-bdaa-0a1fbdf2ed87", "sighting--bf43fcb6-a20e-4234-902a-e6aad6aad598", "sighting--9b8b6faa-13e2-4448-b09b-7fe38c431c9e", "sighting--f250ef6c-b4db-4dcd-b891-d0d3fe84cee7", "sighting--1212b47a-a56d-475b-8141-ec9b804a0afd", "sighting--d11079f4-212f-4a91-bc37-2a7eaba265f6", "sighting--2f711beb-5685-46fe-8483-c49f52fd5728", "sighting--e8e1ceea-9c3d-4a89-ad4e-c644e9dfeb23", "sighting--54a83910-a291-496d-b1d3-ac3453f076bf", "sighting--41a083ca-e42c-4caf-8717-4d656f0e781c", "sighting--65e610ea-2b2f-4fac-b677-111fd304b357", "sighting--8b7b5b0a-4b3c-419f-b472-b414c69696a8", "sighting--7cdc6c8b-7b4a-43fd-8aa7-960ae266accc", "sighting--52a5aaf8-5222-4d47-acf2-df4b386c25a7", "sighting--c978223b-08b7-4566-953e-d174a5230b01", "sighting--fdbcfc4d-60cc-4824-b38b-ad9a30724653", "sighting--0992df0a-9e2c-4e8d-badb-9a348f638b56", "sighting--aa8fe4d2-c4f1-4ea9-af66-759c718fccba", "sighting--0df50ffc-ce8e-430a-8b45-278744b8dfda", "sighting--9e03d791-93a5-4245-94bf-016d853d16d4", "sighting--5eb86116-f800-486b-aee7-aaf8b19a9826", "sighting--f8bc5166-3833-4e81-ac14-9e350168c050", "sighting--4f03ada5-d202-413e-8385-488339266749", "sighting--83fbd14c-0a91-41b3-9a58-1944e99da4cd", "sighting--72726c9b-4340-4b7a-adf0-0689c2af1b21", "sighting--3fac2fb5-262b-4c27-8dc1-7bd5be49ef38", "sighting--3457305c-5155-4287-8485-93947c0a2b42", "sighting--3f9e47d2-7c12-4098-9151-b290d854bd51", "sighting--3f36f485-c242-4848-937a-60a79ef4fd28", "sighting--27efe84d-cad3-498e-9c3f-e123832d19ba", "sighting--cbf31373-dcf7-4f0c-9d19-b98cf0568544", "sighting--4c80d180-c3c6-4cc4-8e0c-a9462c0a58e0", "sighting--9135bc47-cdd5-4d99-8d7d-4525ff8dab51", "sighting--f57eed9a-c179-4870-a096-5d13215983c2", "sighting--9dd5fbad-ca02-49ce-8dcd-f3ad04399b6f", "sighting--5c709eab-c0fd-432b-b606-9a2dc7419d9f", "sighting--6d427912-9ca2-4095-80c9-95f6c658f79a", "sighting--1a81e189-b0a6-432e-9b4c-c01030521164", "sighting--465b2e04-2ddf-4dcc-91d3-b2c06dfe1b4c", "sighting--e542571a-dc77-437a-98fa-200decb2cc1c", "sighting--4ff49f90-e284-4a93-a66e-15c4b21ed551", "sighting--efd3da3c-141a-463d-88a3-aea55934abbd", "sighting--a2eff556-5f72-479c-9f92-af319b443385", "sighting--4c28f7fc-c2dd-4c77-af64-35bc6f475af4", "sighting--687c2d2e-b744-4652-bc36-f4e75d44b81d", "sighting--7e7b0f23-7368-4813-826d-a82ee4c61fa9", "sighting--144bc6c0-c9c7-4fc4-b31e-9d3e79cf6d23", "sighting--cc5387cf-8f14-4860-8c4b-68084848ba55", "sighting--5def5c44-be4d-4053-8484-3edb79cc3f31", "sighting--7a1a7595-7901-4819-a282-db5fecec6a01", "sighting--dc44a3d7-730a-40d5-a91b-ca75b9f8dca4", "sighting--d23bc91f-6a89-4800-a0be-2601294b23b0", "sighting--a4f7d8c2-0d0c-4970-98f8-22e5bd82d89e", "sighting--1207f960-f8e5-4eff-b338-f35a6a603000", "sighting--66010dde-8090-48d8-8a9f-583da64d86fb", "sighting--c5bc8884-0153-4b66-8087-b94d699873ba", "sighting--1e58c759-be4d-4fbb-b3f8-6059ad3d9643", "sighting--1b628e1c-83fc-4569-b410-aff76b566d9c", "sighting--f2f0b3d3-aa42-4837-8fe5-16d78e54e7ad", "sighting--4a9d6749-fa7b-4b1e-8331-d3cb50a5583f", "sighting--baccf2f2-a10f-41b0-96ea-68ee974ae658", "sighting--a48bd315-c67f-4507-90c4-c184f7adb37b", "sighting--083c0fbc-b497-49d2-875f-eb504ac4d915", "sighting--168a9c78-6b5c-4bd6-83b4-24f3d53e84ef", "sighting--7e59596f-42af-474f-a058-c16026c917b3", "sighting--901d6757-c9b3-42f5-8309-9247cab62811", "sighting--fd5074bd-d8a2-473a-899f-f1dd0817f01b", "sighting--9e85acea-d554-4e60-80bc-7f4955b86ac7", "sighting--1d618911-43e2-4305-bf15-a2ce4221ed1c", "sighting--c00ed102-01d5-4e01-a265-8bb6ebf9818e", "sighting--42fcfb7e-aa8f-4a8e-9053-9b666c8ae63e", "sighting--5023fd0f-efe7-4604-ac51-3242bdb6bfcd", "sighting--e7a2c32d-4eca-4531-9be6-1fe6e467dcbf", "sighting--c9ecd690-2992-4ea3-bc01-18f0d8cfb028", "sighting--5b94bb63-3b9d-40e4-828b-c1c92edc7094", "sighting--a181397e-9df3-4a97-a8d2-0c6ff187d5a3", "sighting--a53179e8-f54f-4de4-901b-8628259da422", "sighting--e2301f43-393e-4728-8e2c-171017ad3065", "sighting--d9005b81-457e-4189-862b-24651ce7705f", "sighting--f034d44b-794f-4cec-8759-94b227addc46", "sighting--28ecb165-3af6-4708-a536-5042e8cd0a58", "sighting--15e4a072-c85b-4326-8d71-0415d2e13e72", "sighting--22ec90fb-c16e-4577-8733-6a86fc3af359", "sighting--1dce3b85-7bea-486c-87c9-89e49fad2910", "sighting--eeb52c76-472e-479b-b513-74986ea0ee50", "sighting--407f55e9-8672-4cfd-9f42-78de360e0ca9", "sighting--1d751290-50f9-4232-8d27-0badd958a538", "sighting--3d48db3f-0771-4408-918e-436f0747ea91", "sighting--47fc760c-bee2-4262-b1b7-4a507502c0e0", "sighting--f60cf9dd-9a22-43cd-8e2c-ee9dd41dd122", "sighting--2dc84bbe-c15c-4427-81be-d0292944e49d", "sighting--3ac770e5-2ce0-4638-acf5-7cdf3eb2e6f7", "sighting--e388cddc-bb82-4338-b3b0-48ac723edbc8", "sighting--af09b3a6-3d53-424d-ba6d-d236b2b34204", "sighting--4a5efde2-7fb2-43d2-85a2-d710d31cd7c1", "sighting--7556fbf1-a32c-45d0-8672-44e78912eeda", "sighting--263ed5ae-0b21-4cd2-86ae-40d1e1069dec", "sighting--44a35b42-539b-4b64-a25a-5620209fafc9", "sighting--a4578373-54c1-4903-a10e-b06dff174319", "sighting--19dc78f4-072c-40fa-81fb-d6eb3f7a39d8", "sighting--71679248-e9d3-4a0e-be77-bdc4919f70a3", "sighting--a7cdf879-3160-4741-80ac-5dbfa956f86b", "sighting--97d10fed-6a42-4ae3-82b4-681202a2831b", "sighting--5af0d09a-3768-4b77-bc82-c726e5b0d787", "sighting--b119aa14-1ea6-474c-80d1-56289e4029f9", "sighting--3a76e5a5-5b1b-4786-bb03-e55a7e7d73cd", "sighting--ecd7ae82-8e42-4493-8055-8120d8a25db5", "sighting--9a21b28f-fa3f-4b28-b4db-97261a67fcf2", "sighting--ef39d428-5590-4482-bd1c-67fd0f82c416", "sighting--4736b320-4b36-4b7f-8225-8f036f6b25a4", "sighting--a7370102-2498-40ec-bba7-acb7fc015b52", "sighting--4810d66e-7c1f-4e54-87bf-a1cc4731b6f0", "sighting--86769ad6-7646-49d1-a9e7-e020bc42e053", "sighting--14cb1a3b-f0ac-48dd-8f7d-8e4ee31eb3e6", "sighting--02a04f04-efce-43e8-9de5-4dc6bf0e7343", "sighting--20b99b51-fc36-4d2a-b6d0-80c73a359974", "sighting--0f5cb8ca-2340-466a-a709-02fb3a45c891", "sighting--f60de819-fecc-49bf-abe5-2c090a51b287", "sighting--6ffca2cf-a769-488f-8ec2-88d68cc185f6", "sighting--753b006a-ce84-43ac-903e-04dbf20a99ed", "sighting--e31a783b-7fe1-4282-9893-73bd7efb8fcf", "sighting--aa539808-b308-4205-87d2-f445708c88a4", "sighting--fc8e5960-ccc5-410b-b264-6e6f4576632a", "sighting--949f42a4-1716-445e-a452-46fe10fdb1f1", "sighting--7945989a-8c94-4082-b032-a748cca0d482", "sighting--811d0e3e-0f6d-4545-bb58-d366da762baa", "sighting--1f2023e8-7569-4a60-957f-6df5aa5256a6", "sighting--3677e3f6-6b3c-46b9-ad6d-436dfefe1153", "sighting--ae1f226c-e27d-4d52-a08c-619440f8a7dd", "sighting--a4ad84ea-57a4-42e8-9628-609ab18b78f4", "sighting--8b1df937-5a51-4478-bd40-6dec7c19247c", "sighting--168582c1-cdcc-476e-9b8a-23422eb45a53", "sighting--f8d6f9fc-076b-48f5-a864-b5b7ebdd1fa7", "sighting--4d5762d3-813b-4006-b806-5d17dd03a7d9", "sighting--9155cf8b-dea8-41e1-a435-639f66edaeb5", "sighting--26172d2d-f09a-4522-afbd-3dfc2e90a98c", "sighting--4bb2d0c7-4568-4aa0-83c8-fb9917343e9d", "sighting--48945301-95f0-4b7b-9e42-bc7e8308946d", "sighting--266b67ec-343e-429a-818e-f20ece70d02f", "sighting--1352771f-1e5e-40b1-b2e1-4f0be050ef90", "sighting--6c230d5a-f941-4a37-902e-15b529383fca", "sighting--17b59f9c-c92d-466f-bde9-cde8be22628c", "sighting--4566a359-1fac-4940-86b3-8c9e1f56cea1", "sighting--76c0319c-7bb1-4596-82f0-ac1e34c4bc01", "sighting--24b69a00-58c6-4c72-957c-3c937271627b", "sighting--66208ae3-e22d-4d67-923a-d964ca81f784", "sighting--06af59bc-e6e8-4504-9385-af20017a54a5", "sighting--d9e5f431-bc14-4e5c-b921-31dc4681a54d", "sighting--b6d22e80-0acf-4b0f-8121-255d86ac0c8e", "sighting--6a94204c-94a2-473c-bbd0-62b2dbc0cb20", "sighting--5eb44a57-2cdd-4a68-8779-5221510f6c08", "sighting--5d537493-7107-4f82-9072-269c58ec59a4", "sighting--a37e824c-769a-42e7-afa4-796e8a794642", "sighting--6866d810-4bbd-4a46-bbc0-f53c3f8e1f09", "sighting--f4e57550-2724-4dbf-8ae5-45e23f525e28", "sighting--8deafe41-da28-4efc-8735-4c7322484f6f", "sighting--676992e3-ebb9-43f9-b005-f6955c0eab43", "sighting--e322f734-7fee-443b-9d36-4109e98653dc", "sighting--91572e93-fbae-42e7-bbbe-98ae70bc40bb", "sighting--3dd6e1eb-2611-436b-b09e-c068ca34d8ca", "sighting--4af67989-1858-4692-a0d2-fadf9db9d0e4", "sighting--a99ec8f4-1d34-4351-a040-42c43bd94f40", "sighting--e93b38f7-3c6e-4274-9b88-17662b69254e", "sighting--e5c0ec86-5781-41f6-8bef-8d4de5d7fcab", "sighting--34c2b1e1-b6e7-4e3f-976f-3ecb7cbd2cdd", "sighting--28082853-4c35-4a27-bc40-1091867aeceb", "sighting--74369cd9-469a-4c5c-ae92-ae50fd658d7f", "sighting--470bd9c0-4222-4a40-ad5c-3f27689d57f1", "sighting--c07a67a6-a15b-4231-ab67-855bccb1f75e", "sighting--f7a11164-0299-44b0-a9c4-aacf5347a9cc", "sighting--ab61f26d-aa2f-4584-80bf-00f06e638245", "sighting--7128061e-76e5-4280-8ef9-c2183fdcbc73", "sighting--693271a5-663b-41c9-bde1-2a0eeca2cb9d", "sighting--dc769878-1697-4b40-b337-1e057a8f274a", "sighting--53008b51-5442-4fad-8f5b-a806586d7326", "sighting--b50d4f4a-544b-4dfa-abda-8549139cd39d", "sighting--67ff3224-4c66-41c7-a8e0-2f9884d1e256", "sighting--3693ca44-0349-4472-b73e-aa93a1cbd412", "sighting--aa547932-5481-43da-bad7-a59c7a9dacc4", "sighting--134b12ae-0f2c-4448-a241-e769c1126449", "sighting--9fc1963d-e229-40a7-b1b8-8087d24aa2b5", "sighting--a547857d-cace-437f-889d-94ae5489b1a1", "sighting--9f61da82-8ebc-4f01-ba5d-452537c207b2", "sighting--faaaf7e6-f285-4049-8fa3-3f44b70b1c10", "sighting--09a27ed6-e41b-4be5-852b-b48599a80bf0", "sighting--9e3685a8-b609-405a-a372-c203058baf00", "sighting--67101073-e7dd-4710-9a68-e549cfb29b49", "sighting--b2004e93-c4ba-46df-a41c-1194a2904190", "sighting--44e1af95-5649-4977-a813-4605c22bc627", "sighting--21c5e7b8-17c3-49ac-9744-ad9e1bad202d", "sighting--32336c59-318a-4089-8b2e-dd3bd48a99f2", "sighting--c9e49a4d-b3de-498e-93e5-48bc1db07f4d", "sighting--c7dcbf65-eb29-475e-aca8-c86c8d3ce64e", "sighting--0c980936-0955-4096-a4a6-569ed9d82177", "sighting--8676ea16-76cb-4904-8fd8-b7c15a94ddf0", "sighting--50c9d37e-81c9-44c3-8618-4f7ec9be719a", "sighting--af4a9ee6-7e5f-437c-9191-c66a0d5d7afc", "sighting--9dfd1635-6221-4f6c-b359-8abb440abb98", "sighting--3c5ffc01-9946-4f5f-b8e2-16ef6b2f88e7", "sighting--5d3c40bb-a0d7-4db5-b821-2dcc52913b1d", "sighting--62ddfb8b-3d1a-404b-bce6-8d611bf2723e", "sighting--629d39ea-75b6-4a30-8402-94e0061a402a", "sighting--d365183d-d172-404d-8250-5257e8e82f7a", "sighting--e46c6801-653a-4ebb-8f4f-f190833e8876", "sighting--544bd592-a624-4725-9af6-9e9240646cdf", "sighting--89867a8b-b2fb-422f-941f-99237d1717ea", "sighting--eb0fadb2-13ea-4981-9131-984c13fb7444", "sighting--3ae1ec4d-75a3-4bd4-8a2a-12876e101ce7", "sighting--1e6a1e9b-ee34-42c1-b8a1-4f3c9a1d2a5b", "sighting--a3249f6b-ddb9-41f9-b26c-7da42edcb65d", "sighting--4ec11728-cb3f-4b5a-b10f-68b9296712b4", "sighting--60a4e5d3-6f8b-40c2-b7fa-f66daabaa350", "sighting--1df3e7ad-1629-45bf-adcf-de26e2b36e2f", "sighting--64d86d47-f39a-44ef-a543-26aaba4374c6", "sighting--7aeb1368-5e67-4e62-9e05-aa98f4176b7b", "sighting--32fdf55a-4925-4229-af7d-5cc5d2bfc653", "sighting--9cdde3a9-c9af-4165-bfc3-2b3cb7981b1d", "sighting--88a8c1f7-500d-48b7-bf6f-658da084f486", "sighting--6a509c83-9c1a-486e-a066-9648c203f9a5", "sighting--7b1dd478-2d2b-4bc8-9f90-6375f22d6cf6", "sighting--333150d6-6eba-4865-ae64-1c7ce5961321", "sighting--0065e9d8-78eb-4e01-bdec-74860c9558e5", "sighting--1982a138-0d09-4c4a-be38-a6e7d871fee1", "sighting--566dc74b-3e03-48d1-bc82-5bb838ba7ca5", "sighting--4628b68a-2838-4c3a-ac7c-ed1040fb63c9", "sighting--0ef90456-dec7-45a9-b32e-05faa41b1d2a", "sighting--9669e22a-9b10-42d8-97f0-b43d173d5e40", "sighting--b44ea0eb-e232-499f-82b2-52b33c308ed9", "sighting--2a32a8bf-8168-426b-b964-0c24e3c26451", "sighting--04516806-bcc4-4996-95f5-a4ea42b9e7fe", "sighting--afdfc9a8-9eaf-4312-97e8-6ecb06746ff0", "sighting--9b5154e9-8544-4dea-950d-a846e3b47972", "sighting--b3e757b4-9029-4215-a5d2-16acd8c934c3", "sighting--270fac43-1481-4f51-aad1-4839eb8863ea", "sighting--6deb9c5f-a6c4-4c57-99b3-e215ec563a14", "sighting--c1f033ee-bb5f-4dfe-b7ed-77838fd682de", "sighting--829c9cd8-0c4c-4000-a959-efa8971ca4bf", "sighting--6a310596-abc8-4092-af00-9f023afa5012", "sighting--6d031543-ca72-444b-acc5-a125667ab369", "sighting--abab3fa2-ba30-41cd-b85f-8a903ca2dfa9", "sighting--82f0d35c-e85f-4b71-a601-a9f13893f5f9", "sighting--eeb18275-907f-447d-a816-be39ca0c2876", "sighting--3de05551-456d-4b05-8cff-79929a77db74", "sighting--65b7306f-62ba-4d3e-bb30-f5b745e4722f", "sighting--6d293067-4e40-4037-8cf5-fe4b527721b7", "sighting--2ecb85a8-e938-4797-8bec-a4995dc157d5", "sighting--0783675c-8a35-421a-b6a8-1619bdb5e8ed", "sighting--597369b8-892a-4964-b1f1-c65a39ee7287", "sighting--9232137b-b17d-44de-85ac-540174d9de8c", "sighting--e197c143-1bb4-4ea1-8569-e5d7f6d7e087", "sighting--22d2a91b-cc87-4b58-aa07-f005852e037b", "sighting--17612a09-78f2-40a0-93a9-3c2126cd2828", "sighting--e8751bb2-76d2-48a8-aa05-29f7403ab0a6", "sighting--10a528db-bc4b-461a-a77b-59cf9c0e163d", "sighting--8b055125-e05d-4c73-9784-1e5415da0702", "sighting--834df1e6-68e4-40a6-9c27-86162019f76a", "sighting--fe189c18-bdec-4dce-853e-79a486acaa10", "sighting--131f1e60-a3b3-43ab-95fb-bd52e9ff2623", "sighting--e8ab66c7-2efc-409e-b35a-82bd3699b3f3", "sighting--60698b1b-a4f4-4ac4-8ac6-3c7bbb14745e", "sighting--097d59bf-35a1-4349-af56-c7913c7783a6", "sighting--0ade943c-7b7f-4c41-a13f-7946a7430b21", "sighting--541a1784-a66d-4dd8-b3ba-66f55348bc59", "sighting--3e85e5dc-11a9-436c-b2a6-a1f5e50b8afe", "sighting--e460d94d-5472-46bd-8e6a-986a04921220", "sighting--da162f91-2d5f-48a8-ba2a-3714f7ea7511", "sighting--1dbfeb6d-30b2-4b49-aaec-52ba8b166885", "sighting--75da530a-c0bf-4007-8c17-8b35c74ab6ce", "sighting--9d6ea0e7-73d1-4d05-9794-cfdfded44efc", "sighting--b7d3c122-0cb5-453b-9da0-125cae82d09b", "sighting--5674026d-09c2-4ef1-8c57-5361c7333e22", "sighting--689ffcab-26d1-4cdf-9019-e20268d92504", "sighting--7f653f41-dbab-4036-a4a7-3efb9775d29d", "sighting--e0817883-e52b-4373-b81c-ea98a370df11", "sighting--bd239205-38a2-4d11-b1db-9cfe9b906423", "sighting--e6236e2f-f641-4057-88fd-5cb3ed0b3166", "sighting--cd51226f-53bc-4af4-8da6-2d93f348c366", "sighting--1cd9a7fc-0b71-4a28-bcd0-dc1d2108e827", "sighting--9d0bd59b-d3f1-43ca-a748-a8a1345fa228", "sighting--0bdedc52-9c67-4c04-a113-cac41b9ebf74", "sighting--35e08eb8-0c66-40e4-a8ad-4078dbb2453d", "sighting--3de8e7e7-614f-44b7-9443-a9b53f2aacc5", "sighting--d95270c9-3f00-4702-88d1-13e3a3d028b7", "sighting--8dc29132-1a4f-4918-973c-9f99e4657c7a", "sighting--0e76a56e-b125-4041-950d-2512362dcecb", "sighting--e0bddf19-e4a5-4d81-ae06-a0ee71f57f16", "sighting--dc9dc498-edf6-479e-8aaa-b442b1ebfefb", "sighting--2313d3cb-804f-4575-9f12-da62e0742ec9", "sighting--0748bb1d-2658-474f-b77f-54038b44f2f4", "sighting--1842f21d-3a0c-4a98-abc5-2adaa419a579", "sighting--d36fe3fd-69f0-408d-8b5b-2af5face8150", "sighting--6686496b-84bb-49e0-8af1-963b3bfff718", "sighting--35f920a2-8a2e-4fc7-9074-8a88ff066b22", "sighting--702078bd-1d10-411b-93bb-6a81574e1574", "sighting--d8ffa786-efea-4d14-8d99-c35bae1daaa6", "sighting--4f767494-6dac-4a4e-940b-1a73c7112af1", "sighting--e1d567ee-e78b-44d5-b5e5-5e645dd3435a", "sighting--aa001c72-d736-4e4d-82c8-8d7884db1e47", "sighting--917e745f-d8b1-4a97-b605-e5966070df8c", "sighting--de3a29cd-b9ed-494a-af13-98e6944b24bd", "sighting--6f44281e-a5e5-4917-b3ac-de37369152c5", "sighting--8d3425e8-19d0-43bc-a788-2b8e2d346dc0", "sighting--2e2e0d4a-0337-4cfb-8347-292768760972", "sighting--964e0af9-cce6-471a-ba39-83c896ef5c70", "sighting--00079394-123a-42cf-aab2-d97c8649d06a", "sighting--e574161d-e98b-4114-b1b3-dfeb41f54bbf", "sighting--2136900c-efef-4437-8805-58e910720277", "sighting--471980d7-b8ac-4c3e-a3f0-8eca75127c9f", "sighting--28a459df-7571-4136-b35c-841367e0242f", "sighting--d979094b-1c4c-4796-a186-d81d5bc2ba02", "sighting--2179eed8-10f4-4932-a1aa-865c84a79a52", "sighting--f39ce5e2-9f8b-4530-b2d8-fea92a396190", "sighting--dd4e80fd-4f68-4a6c-bbc7-26f2c26dd9ee", "sighting--5e6a4837-7d39-4cd1-9d20-62f6c2824068", "sighting--e369cf2d-13bf-48e6-8d69-29dba02efa0a", "sighting--f8b655c9-2e7b-4ec2-a7eb-9fd42f76091b", "sighting--a9cf5e07-79e9-4191-8b73-42a9ed3cf326", "sighting--d7a0c4ee-e7fb-4a4a-a020-ac1b765cd21f", "sighting--d972ced7-c4a7-410e-b20e-5ca23bc30dfc", "sighting--ff44ca3b-c318-418f-b598-526d5cb0d483", "sighting--4579f0c2-2018-4fdd-b2cc-2ccb30250862", "sighting--066680be-d6a5-407f-9501-cb09580808e7", "sighting--65f9c0d7-e87c-4f31-819f-ef258d772e05", "sighting--51fed6fa-46a3-45a1-beff-ac86483df2c1", "sighting--436cc87e-656b-47ee-b27a-905d91e3ce0c", "sighting--a2239a05-4f5d-4d74-b8f8-6567e097764c", "sighting--4038eb3a-6690-4999-a8f4-9dfac2df0f46", "sighting--d4e28cfb-15f3-46a6-ad74-ab3b1c120776", "sighting--d16ff102-9e3a-415a-a49b-1faf88bf8970", "sighting--e1cf2e4f-d2ad-4e3a-be14-b0fcefeeda52", "sighting--88c604c8-1499-4513-9053-bd340ce99663", "sighting--150992e7-aecc-42b7-b454-34781dd335d7", "sighting--88678323-477d-4e1f-88ee-6f9c8a6f82c5", "sighting--48cb16c7-4806-45a0-8a53-d24256a131dc", "sighting--e7610e50-f4f3-42a1-86fc-aeabf03f659b", "sighting--e88402d2-4287-4309-b4a1-b62d83e2df0e", "sighting--705b976e-25a6-4042-88d1-a6cb82b6e0c5", "sighting--a6c6fcb1-5f59-4e7a-af14-23051ac69076", "sighting--268e34cb-0805-485f-b6c1-2f510cb184a8", "sighting--a0f646c0-8aa3-4503-bbe8-a09e2d939bdb", "sighting--a8d3aef5-f675-4ac6-9029-bdc88ede962a", "sighting--0de1a405-b906-4e8e-bd11-e3bf142e28cd", "sighting--a6806907-083b-4bb9-b6e3-9024ba15b6fd", "sighting--57555f81-20cd-4868-bbc9-7469001ed22e", "sighting--0b79c811-d14f-40ed-a7a3-6d282d4e162c", "sighting--8cca979c-58fa-45dc-ab4e-f934bf14e84d", "sighting--04a8a0a4-f499-45f0-b687-d7b8b14bdf57", "sighting--570697c7-38e8-4086-be96-91be2b07da8f", "sighting--cd2c702a-8f78-42cc-8baa-680eaff7615e", "sighting--607f780d-a567-42f6-9956-7543df55b071", "sighting--5cc2a635-a39e-47be-ad3c-c0b8037fb48f", "sighting--9d4e320f-e139-4410-ac5e-afb4fbe6518d", "sighting--ee495980-f2f3-4ae5-b88f-0f9759796be9", "sighting--96b9b40b-5f96-4885-b9ed-02539ac3b85c", "sighting--df203279-302b-4116-aab3-3c266f820879", "sighting--1c97cf76-52c1-4b50-94ea-cdf66e690614", "sighting--8fd51f95-9f2a-4160-8048-6b3ffc72dbee", "sighting--c27a0fb3-0a13-4ea8-94f4-dbb7c11a8a3a", "sighting--f5f169ac-d5ed-40f7-bfd6-0451a5e602cd", "sighting--2806aa64-0f52-49a7-8387-8838230368e5", "sighting--352634f8-c5b3-4554-b322-33334af5716f", "sighting--9a5bbfed-120b-4210-9cec-a8439428722e", "sighting--374984da-594d-457e-a7dd-d7e61c2d07d3", "sighting--9d9a86ff-8eac-4bd1-902a-88812369affc", "sighting--7343b5d7-9247-4c81-870e-10d36986058d", "sighting--75a0f7fb-7044-41f5-a443-eb6a6d4c980b", "sighting--778a6560-cdcc-4de9-8eda-6377da59c3d7", "sighting--8fce43b3-5eb5-4baf-8f86-00fe12539274", "sighting--de7566b8-09dd-4c4f-8260-4196b00565c1", "sighting--8c238a22-e3e9-4b2d-8ae5-6805071c2dd0", "sighting--a0582bd9-59e9-4a38-9727-e7171571e8d4", "sighting--fe5df24f-62be-4c69-95e8-104b0201071c", "sighting--d8918aa6-ebfd-4c23-9b49-b2fd42aa51af", "sighting--46f73f65-1254-42e4-b6f3-981134f6a636", "sighting--cd2e53fb-12c8-4971-9476-0c12937e3392", "sighting--9e420c9a-b743-42cf-95cd-9869a76039f4", "sighting--f2ef62da-698f-466a-908b-29a358f75cc1", "sighting--8105b042-d8e7-4a50-a4a3-a328ba96de0c", "sighting--6eebb6d0-1ceb-40b6-9ed5-5468bc3726b1", "sighting--1c14f96b-530d-47e6-ac7a-b632b67f3294", "sighting--520bf6cd-6f0c-4d49-aeb2-4cdda94e351b", "sighting--840918ce-8763-42d3-b6cd-1cb200f2976f", "sighting--03ec6812-c38f-4289-815b-22b476fe1517", "sighting--c3a8e722-65f7-4351-99bc-c22b0e15a366", "sighting--40fa8f9b-8c7b-4b2c-882c-b0c21bc4e85c", "sighting--1e638b59-c5c1-45e0-a392-01a88a251f29", "sighting--955ba899-12ba-4b6b-ba9f-5b92c159acc0", "sighting--249ee7f1-c785-46d4-8d31-3b258bd56cb6", "sighting--d52d460c-ca3e-4a77-bb6a-24ea6cf44c91", "sighting--5c3e819d-ce0b-4a92-a544-7cc481e0d29d", "sighting--3ddda68d-8b45-442d-bbeb-dca193f07745", "sighting--7db88783-64f1-4a2c-adab-fc100b1a68fb", "sighting--dd993a48-f32c-4ebd-a808-587ce7ee0fe5", "sighting--5ec2ce2d-6d85-4229-8b7b-3f0e9a2d1375", "sighting--d8e80cea-b863-4077-9428-a629da14dcd6", "sighting--dc3336ff-dcf6-4d26-852a-430ba806e307", "sighting--e490f7b3-1e6b-4332-8dc0-81964dc3ffc7", "sighting--28803f85-2961-4960-9246-ca9dc93b378d", "sighting--cf5e74b2-738c-46ee-8254-21113a7bba03", "sighting--138b6107-3857-4837-8a93-a8b8501a38d0", "sighting--47bc6833-cf63-45bb-872d-2f60712e871b", "sighting--5c288ce6-98c1-4ca2-82c8-9bf987c24f23", "sighting--5ce10472-674b-49b6-8dc2-b2b80d2144e3", "sighting--9b2d97d9-bce1-494c-a0b5-da2e5d796cbd", "sighting--cdc0781b-49b9-425b-b02c-62324f642e69", "sighting--2886d5c5-11fa-481c-bf1a-d923e57567d8", "sighting--13a064b1-e016-43c5-aa72-88b30b725b26", "sighting--66719597-d6c4-4496-9049-60c5da27b38d", "sighting--647fe1f8-f815-44f4-94f0-fd24cd2b457e", "sighting--149d697e-f7a3-41bc-8c7a-ccfa8d0d1d81", "sighting--c6cfcd3f-6c56-41b6-8a98-9fb9d520e975", "sighting--8dc55bba-ca80-4bf2-b944-fad3cd3c8506", "sighting--c24058bf-1497-4a3c-83f6-68c1098d8d51", "sighting--a330fd54-19af-455a-8fb4-3163bf0a3557", "sighting--0510fa93-6122-40f7-8a1c-2364ec6f545f", "sighting--67b0696d-6546-429a-81bf-5e7334086b4e", "sighting--2e9ae2a7-7d0f-406a-afaa-f0e939510972", "sighting--0a33b886-c41e-418c-8016-932a023e4d9a", "sighting--8b2f12e5-5fbf-48fc-a67c-e50b21844e8a", "sighting--a957706d-8c7f-427d-88ff-15867a0456ad", "sighting--23b4ede2-8fcf-46b9-9059-d7e5e5fc00ef", "sighting--8d22a014-a190-4489-9970-0f08b353a869", "sighting--22bd16d0-5af5-488a-9de0-f7857158a68c", "sighting--584f29d7-fe33-4d79-8c26-9ce30be64d92", "sighting--b35425b5-e9ab-481f-b575-dec4bd56dc74", "sighting--0b1fc577-47dc-4340-a04e-1c92a91229ba", "sighting--5eef1d7f-84e4-466f-81bb-50621e45f6fb", "sighting--83d8b7f1-ccaf-4662-b36e-1937c1f48961", "sighting--470e494c-da30-4eef-85b7-1199430f1ccb", "sighting--bda159e2-a90c-475e-9714-5ee17e6b4333", "sighting--4635ea20-cc51-4277-ac4b-18e08d76c6c8", "sighting--a03ab469-7620-42e6-8d3d-23d393f7c12a", "sighting--456056ad-3eaa-49f3-b1ad-634af304ff0a", "sighting--4440fe00-350b-430a-ba52-7b7501f93ed8", "sighting--51e5838f-0063-427a-a628-c321810c6e70", "sighting--6fbe9143-8ca7-462c-b70d-077273ec7de0", "sighting--a1b0cb26-8ee3-4478-b6c2-d1060cb9f3d9", "sighting--739eba94-8345-4350-aa99-d7c4400ed7fd", "sighting--7cba4864-42a8-4082-9af2-63d167a4aae9", "sighting--0ec6ed45-e4dd-463b-b75d-50b813ce467c", "sighting--0ae0da89-bb23-4502-bd78-78c550a52a4d", "sighting--6b7dd5c5-ef2c-41e8-b039-6734a4d7e773", "sighting--99632b10-b193-447e-8188-b3c2f625f853", "sighting--e88e7ce8-6f14-482c-b506-1f8d6dc07523", "sighting--9e1cd14d-e970-4da6-83e9-2dd887996555", "sighting--108d5a99-eeff-4fda-98cb-98fc8da5e8ed", "sighting--6cdffb16-f203-4b3e-ab5b-34c76e39ad47", "sighting--522fd64f-46f8-4bcb-9944-1e1f9db6fae7", "sighting--53247838-03da-4916-bb82-c1fd105148f5", "sighting--24ca6d1a-bc50-4827-a003-40d23f067169", "sighting--866c890e-d28a-4a53-9c40-439192746db0", "sighting--f8b3325d-9128-4608-9934-70f3add348ea", "sighting--83c1365f-573c-4f18-8554-d9d9ca341b47", "sighting--73707eae-ae8f-403b-8902-0427ff6953cb", "sighting--a485ed7f-b225-49cb-8b4d-c85d6824d7b4", "sighting--c7e59a6f-67ea-41c6-abb7-8ce0767ee3b8", "sighting--4f42021e-a5cb-49d0-a252-a15f2a26dedd", "sighting--3bd96234-81fc-4e1e-be13-31f792a320d9", "sighting--f310c6c0-f26b-48ba-a284-10f0f13d7c11", "sighting--3202fdf4-66ab-4424-a8c5-1982f7b338fc", "sighting--e5212009-cd0d-40ce-bbaa-43f0daf84407", "sighting--4c075f83-ac0c-41df-b3ea-a569e33bbfe9", "sighting--9ebf50be-68f8-453f-a7f7-6834a0c48bd6", "sighting--d89f590f-f491-4289-9390-3cfcc61ec671", "sighting--17bdc138-beda-44f7-9117-a6c55ea60002", "sighting--8167d47b-ad5c-4610-950e-c7714b92a83c", "sighting--b7b22f82-5041-4c6e-ae07-9cbb3dbe9c8f", "sighting--5f1f152e-c852-4fcd-ba28-32a1a8e10287", "sighting--e0d6f3fe-40ed-478e-b2e4-cf5fd619d349", "sighting--520c9091-1032-46f6-b592-b277b8dd50b3", "sighting--545bac2b-de84-4397-83f3-b07955763322", "sighting--befcf8eb-d1bd-4529-b6ae-03e7661d477e", "sighting--ef5b8467-d684-4ff4-8654-373ad3bd90b1", "sighting--67e31f4d-8c8a-4172-8ada-5b3793ad5a76", "sighting--fe6240d2-b98c-4533-aca4-729cd9327d3e", "sighting--a9d0a493-b8da-4c8f-87ca-e1b88215dc78", "sighting--6c342fdd-dae3-46a7-915f-89fe9d023d9b", "sighting--bf809674-633a-41dc-9719-57ccac7cc6fc", "sighting--bf87ee7f-9e0c-459c-8d56-dcea22acc6f1", "sighting--9d5a76f0-326d-437a-ba68-82a4c58c193d", "sighting--8f2c3d6b-7501-42f4-88d9-eaefb539973f", "sighting--fa615a05-5be3-4bb9-85e6-259819c8e0ad", "sighting--3d9575e5-4e0f-4c06-91d8-31ee38ad1df9", "sighting--863d3d76-bfae-48ce-a4d1-c3d54c36c11f", "sighting--a77d2328-f531-4462-8cdf-91ff7c7e1136", "sighting--76800840-acb4-4297-8dae-198f8b2ac9fa", "sighting--33c0ed61-509f-4ccb-8c23-06325b70629c", "sighting--919a9a8d-e570-40ba-8c4d-f33df9942bbc", "sighting--258520b0-6d3f-40cb-973b-fced097f063f", "sighting--f786f56b-e070-45d9-8714-c3d0ac956c1d", "sighting--3a1c5dbf-b07f-4ad4-90fa-6fbe1b429091", "sighting--76e89f2f-30da-4b4d-9846-9fbd96a4ec12", "sighting--0485714b-73f5-4f91-b6cd-9237311d3616", "sighting--40ab726a-58ba-40a9-9990-b6ea672e7577", "sighting--0246d96e-10d3-4128-8167-707405df6a53", "sighting--dd94b387-58df-4036-bd0a-a37d1ecaa37b", "sighting--40d38153-584a-43a5-9bc4-2e91f157ed6d", "sighting--54047684-37ea-4520-acf7-f25da6be1fb4", "sighting--9895a3fe-9896-4307-8049-0a52cea5374d", "sighting--7ec2f023-7854-4ed4-b36c-082f63fb26cd", "sighting--31d567bd-0aae-414b-9dc9-c525047d383d", "sighting--d4c8f4d9-cfad-4e4e-9c1a-2d0b21bb931d", "sighting--7353ed05-66a2-481d-bd2a-7a0dbd0946c5", "sighting--5b7aec0a-b769-4941-9564-12536d0da2b5", "sighting--8e7f076b-f1fa-4332-87fa-ae4efac921ab", "sighting--b928935d-f0f9-4809-b076-54b0aa2fa460", "sighting--0fe52996-4caf-4401-8b8d-0aba37e2b2d4", "sighting--dd54bcbe-5404-40ae-8035-53e837153c0e", "sighting--cfa241f3-9834-46cb-8b2d-b11860459f91", "sighting--e50dc0d4-bf88-4398-9b84-c11773008770", "sighting--4fcb81e3-b639-4018-80fd-26a07c0824f4", "sighting--bddebd2d-7a83-4f7c-88c0-410a93a60630", "sighting--3f89220c-e6f5-465f-8644-05320cb520b0", "sighting--84ed4b03-9dd3-4142-9c7e-28962dcc3dc3", "sighting--8511ed0f-250f-4743-bfde-aa20a16e069a", "sighting--0b7c6ac5-1b60-43aa-8658-f9e5f43f6a7d", "sighting--7522b225-bf6c-4fb5-b29e-f7a3e70c5b7e", "sighting--d11d884f-a938-4111-b8b5-e8775cd4e473", "sighting--1a22fb2a-e953-4e13-a732-5577a0cef4cf", "sighting--b5988a91-d081-470d-b0e7-4329708db930", "sighting--0ce9b9e9-d92d-4a75-bfad-8722987d47db", "sighting--468be1cb-7756-433e-b4d0-89c8a4359289", "sighting--0e287423-6294-48a5-8264-ad481a2d3bc7", "sighting--99c615ae-ee01-4bfe-98fa-531b6cdbde1f", "sighting--223386ff-3588-485f-b9ba-90a035d32971", "sighting--993a0268-2323-4ff5-a31c-2750e165957d", "sighting--d6ba92e6-da45-44f3-adeb-8474730adcbe", "sighting--c30ebea5-34a2-4bbe-9096-62592238c78c", "sighting--2ab3b80c-99a4-4a20-895f-04b4fcfea802", "sighting--b3a4fc6e-fffc-4918-bb8b-d5f11d9b5ef6", "sighting--8a70a22f-25e3-420f-90e8-a2aa64c52250", "sighting--405c914f-8aaa-4d6a-bc85-fcd6789916b8", "sighting--bcaa8aec-92d1-4fca-a443-0bfec5c9ed16", "sighting--5e69ab5b-3c28-481c-9bbe-ecd7feaf3a84", "sighting--30c93937-9a49-4d43-8157-6d9e35655cf0", "sighting--fe39f3f4-2427-4256-8891-7f75d6691457", "sighting--4d90f692-e804-4232-a8a8-337a70a50885", "sighting--093e985c-7fa0-4820-8b0d-1df3dc82ed78", "sighting--322edc86-1aca-46ef-9cc1-c2761548dded", "sighting--41911de7-52e0-4116-80a7-08143a2ed4a4", "sighting--136ac323-5c36-478f-a07e-8165a281f511", "sighting--464b0364-eaac-4100-bc30-45e989ee1690", "sighting--3eb1da15-b2b2-4439-9424-8eb38cad2178", "sighting--1b86aa6c-a9a6-48c8-967a-a6efefc278b1", "sighting--6716e648-676b-4366-b3c0-f8feaad0f94b", "sighting--8eb6637b-6a7f-4400-b945-456d54fd81a7", "sighting--e0d5f623-d0b1-46c5-9bb3-a51c61bab752", "sighting--ab8b51fc-4dfb-4240-9c80-62ad9bdf861f", "sighting--96a7378c-443a-424a-960d-674c495e6236", "sighting--8f9bece3-b2c9-40cd-88cd-a1443a27270f", "sighting--7490335b-136c-4c9a-acaf-cf86169d3db0", "sighting--cae16116-3f97-4f42-ac5e-476a24fde470", "sighting--e25a0c37-6a9f-42d5-b080-3bb3403f9c96", "sighting--85d16caf-77ce-40cc-b91e-be891ea510c8", "sighting--11c07714-4df5-441d-9320-15964f5abc8e", "sighting--fe6ff32c-049d-428d-86df-a5a3654e9d48", "sighting--855037c5-751b-4c03-8bbc-8e4071ed486a", "sighting--91c8a2d2-003a-4b94-a40e-9197aa40e814", "sighting--d4114ee1-6d7b-4565-b4ce-b23753fae4df", "sighting--fefe66d3-de4a-4fba-8226-c43620470c0d", "sighting--a78b592f-1a6f-43ba-91f0-f1cf24c30577", "sighting--e4e199c9-14dc-4604-a461-6289aafc23c4", "sighting--c6680e74-4b32-4108-a990-debb8c5c9850", "sighting--1e29c0ea-1bda-443f-b26e-dff78604436e", "sighting--524ebee4-281f-48c1-ae44-f1901346d22a", "sighting--e1d9a4f2-7327-4976-8d40-f057d988c6c3", "sighting--c2c35b14-c5b7-4d1a-b8b8-465a9b0b806c", "sighting--73222aaf-2498-4eb6-9d79-23e46257b7ed", "sighting--31dcc764-442e-4778-9bae-da497645a282", "sighting--d8d2915d-2ec9-4ce4-bc21-6298517ffd75", "sighting--63d47fc5-b2bb-4189-a31e-5e6d2f91b973", "sighting--06489c5a-1d87-4f7b-b7e6-47394c8fdb7d", "sighting--bdf9eb45-1db2-4466-b5f0-07cfb1117c58", "sighting--7183ab78-42fc-494a-8d1d-0a4dc32c2660", "sighting--e48b68be-3ff4-4f2d-842a-f62f5e1c8ee5", "sighting--496adfdd-1824-41c8-8a14-dc19defa9b05", "sighting--79f08a3f-70d8-4208-b3aa-77923e03ff25", "sighting--aaf4b58a-85d7-4f36-b454-b88a26e47bb3", "sighting--459ec19d-2a5b-417d-adce-5a36865cfef0", "sighting--49e08af9-0027-4676-926e-ed5f978156a4", "sighting--6b706f37-2dde-4f9c-b4bd-b5eca45bd92b", "sighting--d8037e4a-6a4d-4703-b548-235b2104c7e6", "sighting--8b8d7e69-a4e3-4fc3-a33e-1b7b10eaaf9b", "sighting--0ad0d2c7-cf17-457a-898a-c7768701e48e", "sighting--cdf2ff64-3269-491f-94cc-dc2a93f2c746", "sighting--17a54c8e-c7e4-40a5-b47f-075abe45251c", "sighting--342ec84c-10cf-4453-9e64-23f5cb867716", "sighting--9587904c-022a-4aac-90fc-999f231d49d5", "sighting--3f6fb810-c968-4769-b5ba-d9d76919bd53", "sighting--354a6260-fdeb-4380-8017-df5fa2736f86", "sighting--f61e1d5d-79c0-4e95-ad1f-919f0c2b96b4", "sighting--934e40a0-2371-4b62-ba68-71483afc319c", "sighting--9e5e4d9e-b2bd-4c20-b10d-f15e11862b02", "sighting--59faeb5f-1199-44b0-80b5-3fe4bd343780", "sighting--2e7bc7dc-459e-402e-a835-b4c27682eec9", "sighting--a46cba28-c85e-44c7-9e78-9909362f33c9", "sighting--7b06cbb9-ffaa-4ace-bae4-0bb17ab0571c", "sighting--266ac18d-94d9-49b8-b689-90c82f233f78", "sighting--86a43c47-450d-4c02-9294-3af39afb05f2", "sighting--6e75b271-6fb6-4e25-b3d0-a868b489fbc4", "sighting--4a2655bf-dea4-419d-a123-4bfbfef236aa", "sighting--1cb568b0-9476-470f-a2f3-7e9352faca16", "sighting--08d207ab-4e76-45b7-a333-295340c2348a", "sighting--b383ead5-c6ea-4c27-af7c-f9b73f1d0fa1", "sighting--253c892b-10c1-49e8-a2bc-f58f0de7d43a", "sighting--09f13e66-ea13-47c2-8ce3-4f9124a76417", "sighting--274f2370-1c76-4f85-8424-956dcf4e15a4", "sighting--2eb0867f-acad-4b93-bdcf-3c582fa0aeea", "sighting--1c164c5f-6531-4de8-98b4-60c7318a4568", "sighting--451c4735-0d47-4f13-88d6-a97e19c1fdbd", "sighting--1f728e81-ee63-4b02-ad87-6a2be15775c6", "sighting--6e4e6112-e2c1-4306-af35-99afa98f69a6", "sighting--af2fe822-722d-4918-bb6c-33fb1aebf3ca", "sighting--fb4ee380-9e4a-4fa9-9bbd-ebf71801d49a", "sighting--8770eacd-06a3-4c8f-90f3-649075e8f8cf", "sighting--6497786e-48e5-48bc-8229-7679a6b40fb9", "sighting--8db3d4d4-8147-40e3-b40f-5279bb4840be", "sighting--1613e580-f74b-403b-8087-f28ddae68271", "sighting--111a3729-5302-475c-a216-c7186258346f", "sighting--4cf8d453-fafe-4582-a0c4-82d908b3a019", "sighting--0bb33888-807b-45dd-bbd1-61845dab5160", "sighting--24999869-4abf-4e19-82db-570088f6e9ba", "sighting--63582af6-fe3b-4174-9113-9c6d5f0e07dc", "sighting--39f7b8f5-3601-4715-b38f-efd0ba5d5137", "sighting--c9ac595d-7f28-4a1c-ac15-dcfd05e13fba", "sighting--7796b69b-0401-4281-9e08-e4402d47ac96", "sighting--91712540-6c36-409a-a85b-301fc52e092d", "sighting--23568751-a2ad-475f-a0a5-b1868d05ed2c", "sighting--8d2d96b1-5d8a-482f-a673-c0cf889d7002", "sighting--1012476f-1fa3-4e25-a6cd-c344f55971b7", "sighting--d794998b-89f7-45a9-aec9-8c8ecd8f3f0f", "sighting--70013434-e5a1-4cb6-a1c0-64ee655510ce", "sighting--9bf7cd2b-f056-4815-9bee-428bab5766cd", "sighting--0239e9c9-4e0c-42fe-ac47-0ea98b68a6ab", "sighting--276a2cf9-1389-408f-92be-276763459b3c", "sighting--24f97f5d-1a66-4803-a888-70f8dbe13975", "sighting--a80af8d3-2769-4e69-8623-baf2155217d9", "sighting--b746b688-9b7b-4d02-99e5-0a256cac0865", "sighting--8cbd6bbd-8606-4e08-b33b-3781fbe1722a", "sighting--5b9f25c9-b772-43d2-a000-245f8ea1d6ea", "sighting--11140480-87d8-410e-83b3-0e1f96398ca3", "sighting--d5d7f7dd-4e03-4505-8b4c-a74df3ef071f", "sighting--cd49495b-3189-483a-90cd-0f64e08e517a", "sighting--2224549f-acb0-49fb-b50e-8626ff631240", "sighting--6ada9dbc-c316-44be-9c08-f03de01bfbb0", "sighting--7152a6d5-8bcc-4237-9341-914704677c33", "sighting--bcc98880-c2a3-49ad-8c5d-078b7d89b201", "sighting--5cbe7f03-bddb-4666-a5f4-a5422c891c22", "sighting--64034db5-315a-4f1d-a7e8-90be737be273", "sighting--7ca89d68-aea8-45f1-ba85-b176a0906be2", "sighting--f8d1f4d5-a69d-42dd-b596-7b3655b92d66", "sighting--a222b621-1ead-4bd3-a499-772242423d53", "sighting--0d96a512-4859-4108-9c07-e2a51b4d4156", "sighting--ce8e34c2-b0c4-4deb-8524-0d8e5b922db8", "sighting--321c2b91-d19d-4fc6-984d-44694de91446", "sighting--bf17ac2c-5e4b-4c50-9c3e-658c58c48df3", "sighting--0f082f19-3b1f-41c8-aa21-1c3820be953d", "sighting--2647051f-a752-4f59-8687-dacb8f6b28ee", "sighting--6e337411-b455-4588-abbf-296a6290c24b", "sighting--075c7c5e-8747-41ac-90e8-52447c96c1a3", "sighting--777b6718-9395-4ec2-b3fc-28575e59f9de", "sighting--b44c3a1c-10ff-406d-ac97-506e2107d0d5", "sighting--0346da5d-7a95-406f-a63f-be6afb2cbcb6", "sighting--1f3f1e0d-b8b4-47be-b081-d1de59293bed", "sighting--8c0cc37d-853b-4a52-8188-64bdde83d9af", "sighting--b2093966-0533-493a-bc04-43205ecfe562", "sighting--03192342-f2d2-4558-9bf6-834382881893", "sighting--0653fd28-321b-4ce1-a6ad-1ef53ea11eee", "sighting--df6b3843-0fc3-42ee-a502-40c5cfd0e4aa", "sighting--eafc7ad5-0c73-4711-aea5-64bdb29494ba", "sighting--c299e91e-cc60-4465-8a21-5084eed28376", "sighting--e763e243-ba89-4c23-bf6e-b51b5cc78a6e", "sighting--eccbe265-9e67-4ed9-bf4b-9f380b677501", "sighting--424af5e9-2af7-4afc-aa9a-bc65a19a4909", "sighting--f7589302-5d00-45d2-af0e-e191ec7cded2", "sighting--1a3f9ebd-254f-44b3-8df6-52e358ddf6ba", "sighting--37f7329c-fcfd-4c5f-a4cd-31e6844f40e2", "sighting--89a658f4-354c-4191-8c44-cc4f31e6f0f3", "sighting--4aafdad0-7fd8-450d-ad7d-aa1082e85363", "sighting--a0b0494e-95cc-4d0e-93e4-dab731b57caf", "sighting--7302fbf9-b198-485f-8de7-5cb4585e5be0", "sighting--935554dc-a3dd-4350-bab5-bab19a1e8284", "sighting--af0b5471-31fc-41fd-92d4-0636d2f9fb9b", "sighting--577fd2a5-575f-4e49-91a0-b0cb14957628", "sighting--6aaf507b-7bf5-4e1f-ae3f-075e5c31c843", "sighting--6037a3f2-e724-4c44-a88f-6030b4e22a94", "sighting--aa8a2e46-4c1a-4543-a2e5-f51629c1b2d6", "sighting--a6278e84-02ae-4dc9-859b-01e72bf0cb82", "sighting--026c7642-9565-4846-a311-25bafbffe361", "sighting--8e1dfaf6-5adc-4385-9bb5-a7d49cce6b9a", "sighting--1b7af5b6-edc6-4741-81c2-d9507bceff46", "sighting--f44c05e8-5e39-4c06-95eb-46ba30b6e4ea", "sighting--0f010da1-5b1e-4f7f-a421-b5fd032bd113", "sighting--038ac53c-bcbb-4e29-9d36-a0b0e7355435", "sighting--22e2e8df-9cf1-460b-a6cc-7e949473c1f6", "sighting--1813b82b-05ae-4621-960d-cc3b6c099d2c", "sighting--e4cbed03-0e4f-469e-a63c-8f47623827f4", "sighting--6311b830-a9ef-4232-a5f4-7b639aa12dc3", "sighting--2d2d59ce-23d6-4fd1-967e-5fd248ca35f6", "sighting--6266b358-02e1-4a23-9fc9-5dd814af167b", "sighting--1b0e5c09-9687-4d02-8cf0-baeaa0fe59f3", "sighting--2a995086-ceba-4666-81e8-14601d52d8b2", "sighting--2c8ffd63-4589-418c-a6bb-65e22d298d8c", "sighting--b39a9f8b-cbf2-4488-8cfa-408092d7ebdf", "sighting--966b372f-a1f6-4806-bf01-2ec6ecb7d068", "sighting--c80cbed1-15fb-4cc4-b561-72d14812fdfd", "sighting--e7ccbc92-78c1-4ec3-8aae-d438a7e04a16", "sighting--83735df6-be1e-471e-9dfc-5f803d5a4821", "sighting--a87f3065-1fd1-4a89-8963-c9c06c97255d", "sighting--0421ba96-19bd-4c5e-87d6-fb3b184fe48e", "sighting--f30b5361-63e1-45ad-be70-8c514eff90f3", "sighting--f52aef25-d869-4560-aece-c8cd907ef052", "sighting--fd5b424f-760c-4bee-a1e0-0617a3bd122f", "sighting--a9993347-9480-43d8-81b8-b378df015d4d", "sighting--de999a19-ae53-41ce-a6a9-4e5c068f0a4e", "sighting--d2c4c2b8-2f64-43aa-9fc6-59671181bf7e", "sighting--4ca304fb-f8e4-4054-b71e-48b0ac21997e", "sighting--91b76faa-2e00-499c-8776-5ed104607be7", "sighting--35d6654f-7401-4985-bb19-2c43463981a4", "sighting--1d093986-2413-4c67-a99f-1d280400045d", "sighting--28927bb7-2d1c-49f2-934d-4bdf8bd86082", "sighting--addeea6f-269e-4f90-b4d0-2ee4c4895bf5", "sighting--50b70c29-3f0a-4bca-a4cc-7640f8bdd9a4", "sighting--c42e005a-3514-4944-81ba-be86bfaf4d4c", "sighting--5ea40645-0f30-4871-b2b3-87faaf785e3c", "sighting--c8b88a2d-b833-4eab-a3ed-7d9ec8df5bdc", "sighting--1b1020bb-b3eb-42a9-b101-1690022cf0e6", "sighting--5ebe33f1-e1d9-45cd-af30-8ebd2e6a0dd2", "sighting--7f0786a3-bd7a-4e04-89e0-7ecec7ee12a0", "sighting--7248fcf3-f159-4dc2-8da2-ad3ae8766e4b", "sighting--8e5854c8-0529-4a5a-82e2-e704e0af618d", "sighting--60259669-847b-47ae-97ed-20695fcb8e4a", "sighting--3acb63d4-c1f0-4fe7-8f36-ee64c08a0b44", "sighting--e9dd2705-b644-4e34-8f89-e50ccd040e74", "sighting--ce14f1ea-6875-40e4-b485-d699dbb3c7e7", "sighting--86ffd85e-4580-4004-92f0-e9bb8a668797", "sighting--a4c76986-54eb-43d3-81a3-1c6f0c357ac9", "sighting--b066b501-2d12-4c19-b9b5-f4401af17a81", "sighting--2f150bfd-64b0-4caa-94fb-ea2b504491a9", "sighting--b8523049-9081-48e8-9116-b4e23a004040", "sighting--184f2320-1041-47d2-9f6b-478836f8e8d4", "sighting--16c70f3e-4eb0-43c7-8a6f-941c77336282", "sighting--85a1e894-00ed-4268-9893-8a7aa895d796", "sighting--8d926f16-a559-4523-a0a9-f3dc10eb9a2e", "sighting--d739d5bf-fa05-4ed1-b018-40fd0eae709c", "sighting--b736de89-3387-4c9d-8fd0-b63dd8844af6", "sighting--4c60d3ae-73e1-443b-aab1-da7c0806dd41", "sighting--a7e3d758-4f5a-492d-9dcb-9c69511864df", "sighting--64a9db78-084b-4d80-b68f-d99f23c98ffd", "sighting--d03348f4-a1ed-42d6-8d60-d709468ff378", "sighting--22ce050b-93d8-4c22-a065-3dee2245a7e8", "sighting--70872e1c-c516-4a21-bc2d-54305a20b016", "sighting--309da256-9e90-4000-8f72-29ef9f4eadc9", "sighting--02d8e19a-c92e-4db8-88f2-a04d68287791", "sighting--446d73e2-9ef4-4e75-a613-506d030de3c0", "sighting--8ad104e5-30bc-4275-b6cf-eec13ac84cb2", "sighting--09d790b1-9d8d-40f4-a2c7-1c07f9c2c45e", "sighting--ddff6ed7-c59c-405a-a302-61bde64c5dec", "sighting--9ca44fd0-ace5-4f7f-aabe-930ab10c3e01", "sighting--b0e074f3-bbb9-45ed-b96c-0d6c854c8bc7", "sighting--3f9ba18d-b4cb-4522-9d1d-4f025e223770", "sighting--f1e38621-5454-46a7-bdb2-81848f746ade", "sighting--ab18d7bf-9ff2-4024-9494-705fd567bba5", "sighting--b88901ab-e1d6-43ca-8168-7d30421e704a", "sighting--84ca6f63-7a66-437d-bc74-28efc44f68a5", "sighting--86528707-a7ad-4432-813e-7d146fb106af", "sighting--5237fd0e-2e5f-4a63-a8e0-a1bfd84f94d7", "sighting--a1c574b7-2d8b-475b-8986-b053999470af", "sighting--344bb910-9047-4981-8548-af975983e65e", "sighting--d24b93fd-e534-4112-8d34-dc7964e75c28", "sighting--6b08fe58-5ead-4a63-b045-0f942d405b99", "sighting--baa22d63-430f-4a43-b9cd-29deceed9874", "sighting--e29bc2d1-17c8-439c-9fde-35566687f543", "sighting--fcd42f5f-dcfa-475f-9d65-ee1fb982bd66", "sighting--5441b924-fb23-409b-ad5a-4920fa19451e", "sighting--a4af8446-587a-4f36-91ee-e339fa546f16", "sighting--f3f83840-49b3-4a16-93bb-55601b36c2fe", "sighting--2fb18e4c-4103-4428-87f8-4be08bc6310e", "sighting--fb135f24-3cf9-40c7-948d-cf9c4ec2e954", "sighting--069d747e-eaf4-4698-8436-7c50a8e26f34", "sighting--c13347ad-c3e9-4fe7-a6e2-709c7fae30ea", "sighting--bbc23c57-9b75-416c-9a1b-42ed62c00d0b", "sighting--d1785b82-0a79-4c00-99f1-7afc7b351ae1", "sighting--8e29f027-9cac-426b-9e29-200a371f69ec", "sighting--96618c3a-3c81-4176-ac81-b9b6b86c020a", "sighting--c2c611f2-5f02-4c93-8f8d-f7d4b17ac3db", "sighting--ffbaeaff-01ac-4e4e-9838-51908e3bda4d", "sighting--3aee6f2a-e655-4e69-b518-41abcdb4c19c", "sighting--225ba6fb-2e87-4c46-8b7b-23f7c281f880", "sighting--a6d93808-0e62-42ab-979f-46f4da9e5be5", "sighting--d1853b3b-35ff-4153-8980-1bd797e4ac49", "sighting--2f952793-2308-4120-9a35-b9adff446fd7", "sighting--2d6eca9c-6198-4549-96b5-c3b3d5b483c0", "sighting--139e1afe-78af-4e7c-ac33-ffda1f9f5385", "sighting--168b1d17-a03c-4b37-9402-900d4f2e854c", "sighting--ccfa949b-17ac-4248-b639-0018d99f5854", "sighting--a16b40a6-b836-4f53-8aee-1f40066b4b94", "sighting--d5cfd28a-837c-4501-a59d-e8312071e8e5", "sighting--c52813e4-8199-4ff4-9419-c927ffef0e33", "sighting--acb88e58-56c4-4ead-8b9b-e4819a9bded7", "sighting--246d5392-2efe-4f29-ba47-1e6d9ab81629", "sighting--e2f9c212-0920-4349-9f90-14983c42c4b2", "sighting--e5e3f323-8959-49eb-a69c-c5a2caaf16bb", "sighting--3dbca557-f855-4d6f-8eca-aafce6c086a0", "sighting--bca933d6-0ada-419a-bd3d-ca8d578c3872", "sighting--6309fdd3-b4ad-44c7-ae2b-e6d7b059a35e", "sighting--ebde868a-1535-41c3-bff8-ed00571ffc3f", "sighting--a9752f80-483a-4e63-be11-3635fbe879ff", "sighting--580d195d-eae7-4b57-9bb6-2b4174f95948", "sighting--444ce0db-543b-4be6-b716-31a423e16b5a", "sighting--cb773be6-833e-41f8-8451-dd215543ed3f", "sighting--630f9980-5d6b-4059-b19b-98fcce6d05b6", "sighting--4fbc1ccf-4643-4c22-882f-5f054d62981f", "sighting--ce81daf3-3fd6-4b15-8066-e00158930b58", "sighting--0990ba22-a4ae-465d-983a-a65cb70032d7", "sighting--97e3b142-950e-4d86-9948-d1bc7ef1e344", "sighting--a1ef373c-5700-4fb1-8075-1bb74b2fb741", "sighting--c0387bfb-30b5-41fe-b6c3-18325c5583a4", "sighting--f44a10b3-1b79-4b6b-8e52-bd16d09875ed", "sighting--392a722c-f1f6-4dfe-9f5e-8f04230dbad9", "sighting--09ee13ac-c35d-4775-b3f5-d3720924608a", "sighting--2fac6054-ae41-4fb2-b2b0-edd5dc6d986e", "sighting--f39fa08c-5569-45d4-a9e8-af637713b5e6", "sighting--d01585ce-9cd6-4e24-969a-ff36d791658c", "sighting--39dd582e-84fe-4b49-9d35-cb92b6e2874b", "sighting--a01eccaa-4e63-466b-8eea-9d1865e700ad", "sighting--33a5d400-8a79-49ee-96a7-158cade913c2", "sighting--c7eef0a3-25f0-48dc-8501-72e85f5e9001", "sighting--77ba0be3-0727-4cbe-b869-2656b9800bf9", "sighting--217dedd2-f492-4281-b023-faa0136658d6", "sighting--e2eb1bc4-3389-48c2-932b-496233667a54", "sighting--fa8c706c-5492-4c06-b374-5b3f21b077f9", "sighting--2974880d-33ad-45b5-97a4-4c48f928d8ff", "sighting--7c2b970c-6829-48fe-96b2-95b7174ceddc", "sighting--f7210111-7381-4f23-949e-2a123be0d988", "sighting--77e1e306-5010-4d8c-b3f0-23a868c0ad9e", "sighting--cc0fc3f1-3ab4-46a7-b7dc-9fcaeea1ece0", "sighting--f6312608-c815-4f94-8c1c-3804a7bae42b", "sighting--6a70832d-2a5f-4f13-ae8b-4928c9004c5b", "sighting--a075e24f-e3f6-4526-90d7-30766477391c", "sighting--878c1c86-fcd2-4c8e-91aa-fd0fa4f94265", "sighting--21c49c8a-ba33-4250-8def-fa8add442be0", "sighting--c5bcc6bd-4c02-4dd9-a20b-7cdfd2180558", "sighting--a9419cb2-6b90-428a-8996-070ae9446948", "sighting--7f0b9032-bb5b-47ab-88cc-12db55511e84", "sighting--ce3562fb-4a20-4cb8-b0b2-4f1822f47eae", "sighting--94d373d0-f6a7-424c-9846-1f8f499639cc", "sighting--b475502c-ea4b-47c1-9596-0b201b5da0e5", "sighting--7ddf134b-c18f-40a0-bd68-e051f520286e", "sighting--6b979ef0-c1c6-415c-9bec-d371db42a6dc", "sighting--2965f817-8b14-47ff-8238-4ce41d01075c", "sighting--09e9aa05-3a9c-4685-a67b-6e5ea283241f", "sighting--62e70a5f-1dc4-44f8-b183-e2e0b5f24d66", "sighting--fe5dc68d-9543-4056-bec3-d26ef0eb4446", "sighting--06e9dcee-e7f3-4d75-b8c8-ae2c9489d140", "sighting--56c75d72-b5e0-41c2-93e7-c34591f68063", "sighting--950b68e5-0553-454d-92f3-73c0eb05f5f9", "sighting--f9ea207d-507e-491a-9513-4baee3e6fa1b", "sighting--f010dad2-bc3d-47cd-8f7a-3c2173792d2d", "sighting--2087167e-b07f-4518-94e9-3ec433d7f76d", "sighting--15f21908-d649-46ac-80d8-5a63eb539b67", "sighting--48c9a9ea-6826-458f-8157-75ac26317193", "sighting--d6af53df-9df3-4b5b-8537-3e696125e0bc", "sighting--26ff91fa-51bf-495d-abda-526faaf0e428", "sighting--150eb0d6-3371-4dd1-9d06-90088b008ab4", "sighting--246592f6-b10b-4904-b333-cf9547cbfae1", "sighting--a41d9c54-86cd-4c0c-935e-04673636a155", "sighting--2d8924d2-9e64-453a-8356-7c5967d6676a", "sighting--32b17104-1c8b-4260-a931-a924befdffcd", "sighting--f90086eb-d007-4ae7-a4be-95401fce895a", "sighting--a397e919-0ec0-4bc9-919e-c17b9909ee48", "sighting--f47c3675-e353-4de4-8610-39ca9121e687", "sighting--4827d542-501a-4917-8331-865cfc68dd9e", "sighting--e91667b5-976f-4511-8a81-941dd863a857", "sighting--2ab21049-2422-4d31-8ca8-223541b09f8e", "sighting--6aee5b12-694e-4642-ab1c-1b041cd58253", "sighting--d2345e6e-7c10-466a-8523-5279e2af2fd7", "sighting--1a0ee1c9-2251-47fa-89dd-831d05c22a74", "sighting--457b95f2-579e-4102-bf9a-23cf3caec1a1", "sighting--ee38a76c-0763-4767-b3c4-4a9d189e5705", "sighting--735f1da3-f48c-4df8-be99-28587d245421", "sighting--c9d1b90a-3e3f-4768-a097-69870a725962", "sighting--87fbe9eb-1708-4890-bf1c-b7c0e2dc99d4", "sighting--ba0f8980-5765-49f7-9178-c11ff4facbd7", "sighting--7fa3efdb-faee-431e-bd07-a094de8e69e7", "sighting--9639d84f-1cf8-4c11-9c1d-ca90e64bbb74", "sighting--444ae1e2-a9ec-4989-afc2-65eb8592bc82", "sighting--431edb24-621f-42f5-9b96-d463093f20f5", "sighting--768310af-8d86-466c-9f9e-4a764435c486", "sighting--443611f4-8433-4aed-ac5c-092505f92532", "sighting--b5938d08-c317-4a26-a136-450bb864aa25", "sighting--d11a49ce-0ea5-495a-af57-e67d2adbf72d", "sighting--9663136b-b87f-4c0a-b62b-d6e6a7e14539", "sighting--889cba84-cc0b-4a85-8ead-7686910288b5", "sighting--3637bea1-76ff-46b3-91a6-772c838eb43e", "sighting--d9eb316a-deee-4744-9723-76e3f4abe72b", "sighting--e4857559-e0dd-4842-96f9-08b87a4e69d1", "sighting--73c360cd-8261-4af5-9d42-4209365ec269", "sighting--4b440340-97a7-40aa-8c52-c03de2e1f842", "sighting--cf76675f-0a6c-4821-a569-2dea2597c8bb", "sighting--7f70e67a-0844-4efa-bd3f-cacc74f02294", "sighting--621494df-06ea-4f0a-aabb-f526c050295e", "sighting--a36c7a7d-911d-441f-bc5f-9c0384c0caef", "sighting--8d22b7fc-bd65-475a-ab74-a54d08f1f0c5", "sighting--4e88ebb3-acd0-4317-a42a-1faddae94a01", "sighting--8fda6354-a40c-4e9f-bee8-d5bc5ae13f89", "sighting--2c826490-b4d0-429c-9bb5-57d7ce4031c0", "sighting--a910030c-8117-4462-aba3-00fd17868bed", "sighting--a91e0ba0-b0d2-4cdb-8324-ab380d4f5b57", "sighting--998aa5d1-d07d-4314-93d1-4481614fda9d", "sighting--7e99563a-8457-481b-a66c-f5f083f2845c", "sighting--a660ff56-4e15-42fd-ab02-6a75f8e31ffa", "sighting--3b675536-f504-4262-a490-4b85de7d7846", "sighting--35ad195b-e352-437a-945f-e065476d80ac", "sighting--2b716342-9dd4-475e-b360-dce159759e4f", "sighting--11139960-d4ed-4e12-a448-c02e54d04807", "sighting--452036c4-4c55-4e5d-9cbc-408009f806e9", "sighting--ca2a5fe5-afd7-45df-b24d-b381c8bc88ab", "sighting--fee816ae-6ad5-4a64-8c7b-7bd05456821e", "sighting--70ed0aab-9c89-4df4-9301-ffbfc340d71c", "sighting--9c9ba308-84ba-4de1-bb81-2d631e413482", "sighting--bce0f091-9eba-42ee-9847-0710abb3e086", "sighting--a5224dcb-9157-4a74-b3c1-d57194a258a0", "sighting--fdca2545-4d69-43d4-8eaf-a3566e43ee2b", "sighting--32567070-738e-47ed-a81b-2f2e726e68a9", "sighting--b587fce2-3f5f-4d63-8eb0-b925f814adda", "sighting--79d350f1-1ca5-45cf-a034-00f88cf271d8", "sighting--2354a0c1-11d6-408b-825e-b93e9e5f6551", "sighting--2980e10e-5834-4aed-b076-ab67b109dc9c", "sighting--cf69e318-2f5a-4e6d-9a18-042093c3f299", "sighting--4c2a237b-13da-4cc0-b13c-6aff3e8b65c0", "sighting--d4eafada-250d-4e09-b7eb-e0028d00241b", "sighting--964a8234-6ebf-4744-aa20-23a3fb216af0", "sighting--47ceff36-741b-4a62-93d5-98c27993e17a", "sighting--b3f965f2-1c44-41ba-bfad-210f8365125b", "sighting--cedfce49-948c-49cc-8fdd-0355158fdb5f", "sighting--a19ba784-358a-404d-be5a-2c1d946c6284", "sighting--8f8c8e7e-4e60-4a89-b451-41e7f205dfbb", "sighting--db558cc5-e1f6-4f66-80ff-817809f028db", "sighting--f4029d33-b23d-46e5-bfe4-3f7ef712c205", "sighting--eada5c4c-4355-476b-9c3d-ac7d67d72cd2", "sighting--26c4c21c-cdcd-498b-b125-a827d8a9eea2", "sighting--f8ea55cd-1ba3-46cc-8757-8ec196678fb9", "sighting--213e6860-841d-4d62-9ec1-e8874fb762cc", "sighting--fc6c1bcf-abd1-4949-aef1-52e622ed78b1", "sighting--4ba75275-735b-457e-a716-f803bf9e3a2c", "sighting--02e2350b-db05-4653-9f03-bfba10a92273", "sighting--64ceea5c-8d9d-4081-bcde-2559c870c281", "sighting--eb1b25c3-02a6-45ab-a9dc-829e617daba8", "sighting--489bebe3-d0e4-459a-9aa7-eb9a300f5d1d", "sighting--2919677d-db5b-4815-ba75-8096ec3109f9", "sighting--bd3b9494-96c9-4920-b35a-6a922aa44a38", "sighting--c7c87ae5-8d30-419a-840c-fcc8dfc04117", "sighting--ac838c9b-f721-4882-b2f6-8f1fd8547767", "sighting--d31b3368-a2e5-42ae-8d70-80a2e26e1bcb", "sighting--7055d51b-e339-4f4d-bdd9-9aa5852f9a7b", "sighting--47092b7d-c4af-4e0a-a0f0-755234c24df1", "sighting--37c6cf83-e02e-48a8-a0b4-bff2e76a0024", "sighting--10646276-9344-4916-990b-dbde7d8f705e", "sighting--89990fb2-13bc-4ad6-bf1c-44c0f7fca3e4", "sighting--e8f208f2-f598-4ef8-9407-07706dd729ef", "sighting--28942f3a-f05c-4ed1-b8f4-fee3d0d5e1be", "sighting--77f7a3af-8f2d-4f97-9110-6ff19eb13b4d", "sighting--c7f3a2e7-1159-46d4-bdd1-1ebfbb176f8c", "sighting--44b4bfef-be4d-435c-b474-5d4245a0b102", "sighting--db48efc8-78d9-4f2b-b64f-aaf9dee46172", "sighting--3afe4685-1ef7-4f51-915c-091ae219ab72", "sighting--f61597b7-10e4-464d-865d-5d9042a4321c", "sighting--a19e23eb-ee2c-433f-8c38-628fbd5a0383", "sighting--da54a823-54bc-49fa-ab76-55eddf5cd6dc", "sighting--4c8b4901-c37a-4985-8ecf-61666a92f042", "sighting--80c4892b-25ae-44e6-8316-e112ef88ed74", "sighting--5bbd073a-ff56-4d9d-9103-411db7b2362e", "sighting--794f20d4-779b-48a9-8071-5823a2a330ff", "sighting--8c3eaa70-b04f-45d7-b6e9-b1b2c859893e", "sighting--68a6a689-6066-4bbb-befc-791ae9a027de", "sighting--c0808608-ceb6-4d1d-802f-51ac57e149e4", "sighting--32bb4d6a-ebf8-4b97-8869-b466482d4278", "sighting--50f74aa9-a62f-46b4-a169-b28477ef7c13", "sighting--1c85e593-9cf1-4fcb-90fa-9d95c2252b73", "sighting--4254de36-c252-4585-9333-0a0a6be4cdcb", "sighting--1fe2c831-7056-4ad6-aed0-07333d913938", "sighting--4960f681-40ea-4e37-ae04-e127f43f16cd", "sighting--15f054cf-6872-4186-a1d9-6887d9aebd2a", "sighting--1b0132b3-0b64-4afd-a7ff-70c80bfdf947", "sighting--1fc07365-a100-4a57-9e05-e8dc01d763b6", "sighting--4f1437ff-4786-4f80-afe1-a73961133c9f", "sighting--db5eaf70-cff3-4819-bde3-31e592768323", "sighting--f01d0420-fc76-4e52-b67a-3783c9c65d47", "sighting--2168007f-8761-4077-89a7-6cf1c976ac7a", "sighting--cb7a3cca-bbda-4c76-8ab1-0f12698cb8a8", "sighting--a23490a8-7a42-462e-82d8-565fd123c48a", "sighting--ed8457ab-b195-448d-a9b1-6956e08b0472", "sighting--3be933e0-09c0-4003-9cf3-9dfbe435f44a", "sighting--fd5cf3db-81dd-471d-a1bc-8494b8fdb734", "sighting--7f4951e5-513a-42b6-8dd1-37d215b99985", "sighting--fd0c4d78-c814-4683-bbd3-b4930ffa98fe", "sighting--04dd9dc3-6864-47b6-abaf-7880b2ad9c40", "sighting--08b1665f-46ad-4835-99e1-c3efcd8efecc", "sighting--dae94905-0144-41fb-902d-ceea0accff4f", "sighting--cf89bbe5-3e10-4b72-ab4f-2584cf3597a3", "sighting--84a1a04d-5dbe-46aa-83ba-321dbadf98ee", "sighting--2e53cd75-450c-4bc9-b299-bb473bd8ea82", "sighting--6a0b70c9-94b1-40e0-b02a-8edd330a5ec9", "sighting--4c89d5af-d7d3-42c8-acd9-a128036e03b9", "sighting--57c28988-1b27-4889-ad60-932dc3712070", "sighting--dbe39bbc-ddc0-443e-ad65-83806cadbfb1", "sighting--e6891d47-68c4-4f38-b1f3-534dbcbc1b06", "sighting--202a451b-c680-4908-8bf5-389734681310", "sighting--6c049ad3-9e73-48b6-8d72-c3802f6a8765", "sighting--6d97af34-1045-448c-997a-a45c121e5056", "sighting--c42cd5cc-f9ab-41c1-beb8-ab66ad7e7169", "sighting--f3f9f8f0-19f3-439d-9bce-818dc8829b9e", "sighting--c984ba32-7364-4d5d-aca7-42e04e3bbdd5", "sighting--4eb33b8d-4838-4ff7-83c1-3fbdf90d8578", "sighting--7d4491af-0f43-4d3c-8fc5-72946ea4eeb9", "sighting--45691de3-389e-4e86-a712-b515e498ea08", "sighting--b8b60193-6842-424a-8e24-2834089a1e5f", "sighting--fa2ec24d-48d6-4c38-8b6d-fd9c8c3d7b66", "sighting--092e557d-496f-4942-a4de-33a860e467e9", "sighting--84f266d8-fdbb-4742-97ef-913ed6088add", "sighting--5c009133-3327-4cc2-9eba-5f8d45d795d8", "sighting--19363c05-be77-4dfc-9850-276307ca2687", "sighting--09f77b48-a7f9-46e1-a37f-08f7296acd6d", "sighting--d1010259-ed77-422f-bd48-dc3bd12d9640", "sighting--0d184652-513b-4a66-ac38-522ddbb44ddf", "sighting--0b460bb9-50da-4068-941c-8eac5cf28904", "sighting--e6159413-575c-4032-a9af-aa38300b250a", "sighting--1778f232-3223-4681-8fd1-111416e820d4", "sighting--a4e4db22-d5d7-4271-a93e-baafa98a3bfd", "sighting--7f0557e7-e4d7-4f6e-bdf8-b53bea1fd0ed", "sighting--b824911b-5e8f-4746-b356-a7b55e41f289", "sighting--319e71a5-c52d-48b5-8128-33f3797f5515", "sighting--d8c93a24-fd92-4eba-950e-4ab98fb54b02", "sighting--6f762b72-8574-4c74-af1a-178169cfdf1d", "sighting--91bac64b-302f-446d-b002-8e5109f7724a", "sighting--e7dc68c0-e051-4c6a-a343-b1784e954039", "sighting--eda7878d-0042-42ad-aaff-8ea946e51259", "sighting--09e98a4a-75a1-4e29-a762-4d69d0e0b39b", "sighting--e32f0845-8b50-4e34-9c96-1ec6ab2f0f8e", "sighting--49bb2aca-dbf2-4bc0-888b-a623f4ccc9c1", "sighting--e779252b-1337-46b4-8eb1-b463d17c1645", "sighting--c582775f-cb8a-40e1-9253-f60b3b8eea7f", "sighting--06b0a0ac-3419-4b59-bad5-0360b4a3e81a", "sighting--28cbb7b6-0a68-49f8-8ebf-df71fcc9a788", "sighting--33394e7c-35bf-4705-a8f5-5821dc95eb40", "sighting--82c9e177-dd4c-4257-8af2-5731fdaaf620", "sighting--e5ffdac9-f0bc-46fe-a68a-fe623cf6dd3c", "sighting--80cc62dc-97c6-498b-9413-9b06adf0df74", "sighting--e0d6e6a0-c741-4f02-a9c5-91a6bbe0faf7", "sighting--82ebcb2a-ba17-4be5-9870-c266cc9e0318", "sighting--94b0b9d8-df6b-4215-bf92-2ceb856712ac", "sighting--a876cc53-5982-4b7f-8f8d-1977668b2d38", "sighting--54dd0b87-94fd-4eb5-81fa-71c29c1aaab4", "sighting--0bfaa24b-4113-475e-a517-02b5aafcef06", "sighting--29c0022c-204c-4aca-b03f-17935cd6eaa9", "sighting--de0a0d1a-058d-4653-ba55-c127ee0161c7", "sighting--710def68-e6d8-4f03-8159-896dcad5d6d5", "sighting--2d1253a7-8f99-4ef0-852d-ffeb16556ed7", "sighting--4b1b7ca5-32f4-482d-b79f-7f751ae3eebb", "sighting--61b130d5-2baf-41b4-81bc-7aac4ad3ebe7", "sighting--bb9df15f-a70b-4fea-add5-770b9f479fd0", "sighting--b18f44b8-e120-4a02-9da2-9b1f42830f58", "sighting--1d4a0723-cc6b-4935-b60d-a36ec8d032aa", "sighting--8e439bbe-0477-46ba-af82-aad8fbfe8db4", "sighting--307b8cbb-5da7-4a09-96fd-9971fabba40d", "sighting--cba96290-190e-41eb-81f0-ee9d90acaa1e", "sighting--0ee7d9cb-67ea-4d64-9dbc-849b0b39cfe1", "sighting--cde562b8-abf7-4012-a67b-1f2b4166ceb6", "sighting--fe29ebc8-ed38-447c-b8c4-29f8239657cd", "sighting--27f275c1-bf26-471d-8d1f-97bc34c35f16", "sighting--293d602f-93f2-4d4e-b188-85831bf2c48d", "sighting--3c5a16a8-e816-40a5-a4eb-968347ca974e", "sighting--f48e00df-35e1-460e-9d3b-ea54202f1cbf", "sighting--997215b7-107f-48c3-9d1d-496827869ee5", "sighting--894814c0-e69c-4074-ad79-4fe5b39de6ac", "sighting--06c26b3d-589f-4da7-abae-1dc890269c6f", "sighting--35123cc3-7b59-46ee-b82a-0b5feb3ccaff", "sighting--36f8c1d9-0a84-4801-863d-bdb2d095bc2c", "sighting--bf6e20b9-93a5-42b5-8bbe-8cdf00732116", "sighting--d4865af2-ab7f-405a-b56c-6d9092e2a378", "sighting--60f6e1c4-0994-44d7-b4cb-4c79d7a3abd0", "sighting--ccaef2ca-8c2d-4a06-8c67-0657ff7cd58b", "sighting--43860b0c-b8dd-4501-843f-48b17d890020", "sighting--245babdd-cd60-4868-915e-07597de88e75", "sighting--5e28ed04-33c4-49c7-8137-c2d88064d147", "sighting--848f007b-7ef6-44c0-bf1c-b4de4138ebe6", "sighting--f11bd7e2-3fdf-42d5-afd3-df986123162d", "sighting--755a5ae8-8ff7-4d53-8026-cb82cf20419d", "sighting--bffc9c55-6421-4b1e-bf15-06a44ac7c7af", "sighting--84bc6163-f7ce-494d-be1a-3cba7be5b284", "sighting--189e5e5f-71c8-4a90-8f6c-e5e642481044", "sighting--404b7f40-9951-4923-8dca-a7bc1bb01e88", "sighting--4c3cb3ad-2270-4455-bf60-225e6863c642", "sighting--40dff059-9e9b-47fe-8e35-795a0f8655f0", "sighting--45bc3a24-6ab6-42fa-9f35-bd0e460574de", "sighting--1b01555e-329e-485c-8896-73b884c5ecbd", "sighting--d40bc7ab-f3e9-47fc-87b1-e99c692e7339", "sighting--56a82ec0-88dd-48fa-be09-d2b0bfc22fe3", "sighting--158f285b-4716-463a-b3aa-3453c203edb5", "sighting--9ab3f482-8947-4eb3-ad43-6031b923bf3b", "sighting--488e9e84-1718-4564-b190-632e96ca24b3", "sighting--d8ec47b0-d375-4047-8b62-c964e9e8a56e", "sighting--34dd85e1-bfc6-458b-a700-9cdd0535ffa2", "sighting--b2456a33-b608-4067-8086-92cbcd3a2af7", "sighting--a97b9532-123d-40d4-a66c-2e70347f70a5", "sighting--ff9732e2-fe5f-4e7b-a302-d0394eb3defe", "sighting--fc829376-bf0e-49fb-a3db-0c1245b893bc", "sighting--c33c8d3e-96b2-44a2-8a60-8a9782be7772", "sighting--8773825c-c75c-4302-a13d-cf3600c67b91", "sighting--d18bfc4e-6efd-47e7-a833-4db0dac10190", "sighting--1430466e-9c51-42ff-8e0b-4e0c1d191ea5", "sighting--2bbd8fb1-d36c-4838-a0db-d63c4f16c191", "sighting--56c6fdd5-1387-4ea2-8408-847a46d39941", "sighting--481749fd-27d5-426a-bf14-d1585c486ee9", "sighting--08723590-51e0-4b72-a3fb-0b260d5a83e3", "sighting--18945f7b-9529-4853-b5dd-eb7ab5f8ae70", "sighting--0197008c-c23f-4b3a-a4c0-d60bc38e2d2d", "sighting--fdc20e86-ff2f-480c-aefa-24c3bbd9b76d", "sighting--4d4d6e09-25d2-4964-a3fe-b225389d0c66", "sighting--bddcaf97-f5be-434f-befe-192958a6e8ff", "sighting--d5e80f58-7280-466e-978b-a41afe661d26", "sighting--5a642c7b-d5b2-4b4e-8562-5f8b99e09846", "sighting--3794e71d-1739-4959-8f1a-3f94cbbdb641", "sighting--217f8a2c-cb28-43a7-a6b1-e0c6fca6a879", "sighting--b1c99156-e2ca-48b9-8494-98874291f578", "sighting--8e661a7d-d19c-4785-b146-97c7bc471e4d", "sighting--d80373a0-f351-452e-82a4-3e06c3eb1526", "sighting--5388d1ae-ff80-42de-b3f0-340cc446cb61", "sighting--646f2408-a068-458e-914e-5e36fad87424", "sighting--2152e523-fc2d-4f7f-9684-cbe8180973b7", "sighting--d67c7bf6-7167-44ae-9851-edbd5309bffc", "sighting--2294dbde-6def-4655-9570-43358835502c", "sighting--3948d55a-1fd1-4533-84ae-9d3247e08aca", "sighting--87d2e62e-46d4-4460-be6e-be65f231c968", "sighting--4034319e-f180-44a2-bcdb-c685df8a68e6", "sighting--9c19a0c0-dad5-4dd6-939d-acebea512cbf", "sighting--16ddbe85-27e3-4357-8c47-41ae83a040f2", "sighting--5089c0e1-1668-4a2e-8ddf-4cfa101b7bb7", "sighting--b272989c-ec6a-44ce-a3ec-a812645461d3", "sighting--fa837bef-0f61-4450-9b1a-ff2dbbd6bc4b", "sighting--de9a7413-87ac-4a44-9127-f4d86b64f628", "sighting--1b9c794c-a470-4c22-a5fd-5474d20a0f07", "sighting--8030ff44-3d09-4698-b13a-3e27cff37169", "sighting--fc2db78e-3f5d-421c-9e57-597deb926910", "sighting--d0763f14-b09f-4c50-b528-c5a165cdfdad", "sighting--61edf531-6ca0-4013-b1a2-d4232efc4452", "sighting--c4fed99b-a98c-4516-954d-01170e620d6f", "sighting--244600da-e0df-4102-b7dc-a3c3acb912b1", "sighting--6e70f201-4392-4185-8822-dca279ad57d6", "sighting--befe3489-9750-4609-9636-805811e199b6", "sighting--8a52f6a1-2281-40be-bf27-158a82572eae", "sighting--9e579c99-307e-4dba-be72-0cd60fddab3f", "sighting--393046ef-0244-40ae-8b06-0375f052a2f1", "sighting--09813cc6-a25b-4022-bebb-59388c5dc1ff", "sighting--6161139b-4023-4af6-afec-2aeec3eccb66", "sighting--03779d11-b88d-4129-8d7d-224f7f663c27", "sighting--e6dd1c9d-07e8-4ea9-a6ff-284e995c7c82", "sighting--bad967ce-130f-4b09-989d-8fc0258c4529", "sighting--281f3019-871e-463d-a43b-c83a3954b5e8", "sighting--1829a00a-96d6-43d9-88ab-5f524de64df7", "sighting--08c47975-0c99-4f82-b3c4-72385204a4dc", "sighting--82572247-4b52-4e91-b522-6e5d48dd7859", "sighting--c35afb22-ce24-457c-be9f-35d688b023c0", "sighting--ed03cf8d-6cb1-4a0b-b690-fe2c7f1f9fed", "sighting--9c7279c1-d088-4231-8e90-e32c046ceeeb", "sighting--d9ae947b-6c5d-40aa-b23b-9b9fccbe2a50", "sighting--b9ae6983-9bdd-4401-a9f0-c868da4c223a", "sighting--e1064812-e2a0-49b6-8f86-655aef637845", "sighting--eb94a969-eabc-437b-9ee2-86e9fc30d688", "sighting--114aefab-3589-4a82-a43c-768de40ee05d", "sighting--2298edec-0290-4815-9b7c-01e72e059c7d", "sighting--9df0e979-31d6-4f38-b259-079052c3c302", "sighting--1bc2f560-dcd8-4268-80d0-53798f9c7c18", "sighting--3d5a1a87-766e-4c0d-8acb-611085148526", "sighting--ad3a4709-0acf-4241-9ab7-e2b7a11fc170", "sighting--013908b7-ab96-457c-9e1d-1ab6615deb81", "sighting--0c2bf334-4141-4258-9d05-bcce2e47a628", "sighting--982c03b6-a9a7-4acc-b956-3f68d43ab7d6", "sighting--5e0e9e66-2f44-430b-86bd-239fef8b6c39", "sighting--51ed6c49-2f74-44b6-bc1e-68e164ebd989", "sighting--26744971-5b92-410f-b944-63c452478fc0", "sighting--be7b5083-d4c9-4277-afb1-4e53c489d5d2", "sighting--5ab92b16-2951-4fc9-87d2-0d145e5908aa", "sighting--b0aed7ff-701c-4a37-a3e2-c7005d0f57a9", "sighting--f01e4a42-81b2-400d-bef1-f0a8642c36dd", "sighting--c6d0af7f-8ed0-402f-9f52-6a2bb01d2da3", "sighting--03c33165-325b-4dc3-8854-03e6cbeb27ba", "sighting--19826b64-5f22-4b87-ba2d-40250e6a9ca0", "sighting--281161fb-919e-4cba-b21a-6c8f50697102", "sighting--84f8c0d2-9a0c-48e9-bfb0-07258560afa6", "sighting--10958b5d-db6f-45bb-bba0-f1a2332b9cc2", "sighting--3eae940a-4b3f-47b3-8787-dc67032aab09", "sighting--54e9a794-fed5-4bc2-a907-83eb8dc3f4c1", "sighting--cab0e8fc-3741-4bf2-b144-29c42c642734", "sighting--c2770ca7-0325-4ea9-8b61-1e3ada04a320", "sighting--8e793ab0-e1f7-4974-996f-c1d7da9474eb", "sighting--803de490-8c1f-443a-a180-e7c3e69ebd6d", "sighting--b5993317-894f-46df-9fd1-1a5953696fbb", "sighting--b35ee7a2-3cfd-4353-8d00-53588eed8842", "sighting--20272589-db26-452a-ae4d-b8ca56f7a9b8", "sighting--cdb14374-3d98-42c2-99f5-34f3007dc461", "sighting--a44dbd9d-7b99-45a1-83ec-4a32c158a881", "sighting--04b4766c-4494-431e-8239-180634cba09e", "sighting--fc85b05f-61a8-4e17-86dd-c01df9842cf4", "sighting--054b4320-43fd-4a83-9ddb-c566edfab0ef", "sighting--139f80f5-75f1-4b73-b4eb-8c1808893ebd", "sighting--c62942f2-d3ba-41a9-a7f9-b851b2f0eed0", "sighting--b7543332-d7cc-4197-ba02-56616ca9a2f2", "sighting--f3f00e01-1caa-42cc-8466-432eaf9f016a", "sighting--20923efd-dfd6-4865-98d6-7848c5bc0c70", "sighting--b29791e0-f031-4be5-8903-d2b6e0140562", "sighting--74b8ef3d-b207-433e-9e9d-7faa3f278cd6", "sighting--27bbdfde-2342-4cba-b0a1-6020fd48f069", "sighting--05365f28-b39d-4b94-806b-7c36c3064dc0", "sighting--30dc8882-66fb-49f9-ac50-08527227bc17", "sighting--98ac9b4e-5588-4cfa-ba36-5be10791ec9f", "sighting--0d254242-766b-4c5f-a32e-f23dd1e37659", "sighting--ef927f82-e96e-466e-af18-6f62efd9f82b", "sighting--800fe63d-c446-4b0d-bd3f-c0f0d025434b", "sighting--7c000acc-021d-4384-b866-0c7d991000dc", "sighting--187f5d7a-626d-415f-a468-929f10a8f27a", "sighting--2c32ec12-340e-4d02-b4f0-074308d8952f", "sighting--1d19f46f-f296-4cc9-8fd3-c52f461e58a0", "sighting--4722bd0e-9ed7-40c3-a54c-01adea067ec0", "sighting--2f2e04ce-4f6e-4b30-9626-cc68d2a0c7ba", "sighting--582dd933-ee88-44ec-a487-d783c8523679", "sighting--edb809a9-d9e4-4818-af4a-d61a1e103328", "sighting--059eb888-12e5-40e3-8a2c-77142a2f37eb", "sighting--2769c5e8-090f-4e82-809d-187934bac7f3", "sighting--0430fcf9-99c7-4937-9783-54eefa3fb6f5", "sighting--1e88b65b-83d2-43f7-998a-c3f690473502", "sighting--720edf4d-dfbc-40d9-9303-68efcb92e522", "sighting--cbc9ea2a-b348-45d5-b180-acfef08ff2db", "sighting--4d5b02c8-d1bd-4fe2-a99d-174366698308", "sighting--c47b06c1-a464-4493-96ec-862cc5671de0", "sighting--015f2871-30ae-4a93-92cc-56d35ea602d2", "sighting--163e52f1-39f6-4634-9236-33b4d33d82c3", "sighting--d08b15a1-2e58-414f-a21e-ae960eded912", "sighting--3f2b0744-395b-42b3-84d5-0fb05da3cbd5", "sighting--c79bbfeb-0447-4bc7-9638-e51a3552b2dd", "sighting--6dcb8de9-4b2c-4c73-8a22-e70d51f60b0b", "sighting--52b93973-22e5-4e80-9eed-3cf356d88f5c", "sighting--89f95caa-cb1c-4619-8f6c-d082837f1cc7", "sighting--009f0ae1-93b3-4c9b-b3d2-526268bb3470", "sighting--4571f4b0-841e-4a74-a181-f9415811dfa4", "sighting--d6d132e9-f5df-480a-9956-14f3addc4c0e", "sighting--5c45afe9-12bc-4f6d-b5a3-702672c73c02", "sighting--c2641f50-0b9d-4202-9f4d-83905c6f7625", "sighting--59daea6e-a172-408b-9c8b-9bed00a99594", "sighting--f4402dca-b074-40f3-9a5b-ad83e00f4bcc", "sighting--1b508e36-2235-4361-b49e-09c66d33c16b", "sighting--57cdfc57-b929-473b-b7e8-b35e1937c5fa", "sighting--266701c1-b948-4c15-90f2-c7cd2d95b10f", "sighting--1cfdf434-3bb6-42b8-b9d6-242d74524b9e", "sighting--873ec894-b583-4dd5-9183-0b339d1d61d6", "sighting--a9a752a9-efca-44c3-9a79-b0f54471ed45", "sighting--41cedcfc-09e3-4623-ab42-781f53788395", "sighting--ea7c9751-b5d0-407d-a76e-fcb1a897c7ad", "sighting--789843ac-6e39-4ac8-8a1d-4abbe682ed29", "sighting--d7bb9a7d-a5b4-433c-96fc-e3443e04f9c8", "sighting--16a4b22e-a16b-4602-96fd-c241d697be30", "sighting--53a6d951-ce28-4501-b018-acf0fa1e16d6", "sighting--c8454567-b81f-4d1f-9f2a-b77391949a95", "sighting--02b1ca54-6b0e-40f1-972c-d3b09a2a1c90", "sighting--ccf43f05-9995-4c27-8b09-55377760170b", "sighting--4e6ce5e4-3ebe-4c83-be16-d2bfae9770a2", "sighting--534b4efd-d711-4de4-82ff-7e06bf2ccf58", "sighting--2923c3ce-fe1f-49be-a609-484e190c157f", "sighting--6813f3b8-f977-4b64-936e-a28c466274bb", "sighting--f98c894f-1da4-4d3b-823b-5647b77aaf4f", "sighting--f63dfc8b-a49b-4759-8b89-3801a380b806", "sighting--c237af5b-c6b6-4483-b877-2ca164edd25f", "sighting--b8cd1c96-ca32-4c8f-8745-07e9737c24a3", "sighting--7f55fbc9-fd2a-41c2-84b1-d509d6db41d7", "sighting--c63c7dcb-5220-4302-9e8e-4e7c8f3302f1", "sighting--3675a531-1b32-4ccf-80a5-fbd450781682", "sighting--a31e0068-2a90-4e45-a280-796ba3929a52", "sighting--05b17ae6-4c1d-4f50-909a-ab0450aeed43", "sighting--6206a573-0e79-4fcf-a63d-8afebbc46801", "sighting--3903f2d4-efe2-4579-a6eb-0841bf101ea8", "sighting--2676bb62-f3fc-4661-beed-5d46234c33f6", "sighting--3c76752a-19a2-482c-ba62-e1e5ab22aec6", "sighting--3c7e3b70-e4ea-4287-9aa5-9a00e4944f44", "sighting--45ecf706-03d6-4fe2-9b03-a3530c1f7f13", "sighting--3ddee713-4164-44e1-98c5-6e2d34b5355e", "sighting--669ee9bb-edcb-474c-bbbb-0a3320fe791d", "sighting--cceaa02c-4fb4-430b-a340-a0d9ce004e01", "sighting--d0522997-fe69-438b-8503-85c4fc57d161", "sighting--29f76415-90b1-41d5-8ffa-4e7361b2bbc2", "sighting--6edef4b3-db3e-4553-8a8b-83ac1da2a252", "sighting--66918b42-4513-4b93-b29f-e7cb571c9573", "sighting--3d0e7845-fe04-4b66-8e48-0293046ceed0", "sighting--d532c313-a42e-421c-820d-b4c928f0c75f", "sighting--8ebf9409-3ac4-4904-a5a7-9f1b05cc080d", "sighting--5bb3da85-b508-49b7-9d33-843ccb3e8baf", "sighting--0873bc35-3eb3-4716-a75c-caf8124ed1cd", "sighting--0cb7c1f7-4c19-4b94-bfc5-5e580f35593d", "sighting--c689984b-316a-462e-8229-2965a719abf9", "sighting--5cf0627f-35ac-4951-94d4-d3cc24f46820", "sighting--3e74a682-a222-44c9-8db4-7dc115e72f07", "sighting--eac07000-c596-41a8-9215-75a7ab28dcf9", "sighting--f9a65b75-0753-44dc-8747-f3c131fa9a1e", "sighting--0f074209-7c54-47cd-96c8-bc5ade160f86", "sighting--adc22ce7-357d-4bbb-92e3-fd7689dc528e", "sighting--664e40ab-5c97-4aa5-bab3-7a077235135c", "sighting--baf06df2-7ea5-4d52-bced-27820c6b92d1", "sighting--a20a4a19-0089-439f-b865-0c11d02ddc63", "sighting--22552e88-73be-4959-bc4f-5dcc06184443", "sighting--714be9af-b18d-4435-b108-e9e6e2813f94", "sighting--700fd280-2631-46f8-b256-9be68e6aa876", "sighting--9931dbdb-a7b9-4e8b-a78e-8ca5f0df6efc", "sighting--476f3d28-48a5-477b-b022-28494debffa5", "sighting--d51d64d9-cf16-417f-828f-4d7e95cbc40f", "sighting--555d9d6c-318d-4796-b0a3-252d0550c402", "sighting--70f32a0d-e6ef-4562-b7d9-d15444caac51", "sighting--eb6be34b-b0b5-42f8-a592-6e4a179df179", "sighting--db63650f-9dc8-4274-8700-f641535d9580", "sighting--6b3d918b-358f-4d32-ac66-4c7437473ed3", "sighting--4884af60-5de4-45ee-9b8e-a0b3e76eff2a", "sighting--2b0514e7-d61e-40ec-84e8-bc1c1b5b291d", "sighting--514b4bdd-b1a3-4997-be9d-cd5014545268", "sighting--a4e36bec-8362-4d7b-ba62-618c0a405b69", "sighting--6b69ec1a-d22f-4928-9b4b-5355d532e7e3", "sighting--5385e9ae-47a0-4be8-a650-e7493b7ee630", "sighting--f529b88a-6079-4a61-b251-7a92add5a2d7", "sighting--a464518c-f11d-407a-87c5-84e8fd278659", "sighting--67ccd2c3-561a-4896-a97e-cced0231f436", "sighting--fdf75f7c-4e61-4848-bfad-b15a5849af36", "sighting--7535578f-63ff-4177-9261-c18d005ab9d9", "sighting--9a5787a5-8a5d-4a5c-986a-2d357cba217a", "sighting--b6587e40-5b6a-4173-ad3e-a2be42c9d075", "sighting--70aca7b9-c485-4995-b631-0c97b4ffe96c", "sighting--4ab95c79-3fac-468f-b116-7dd24ee017a7", "sighting--7fa4cc3f-425d-46ca-9bcc-60aa360f7b23", "sighting--20ed8b0a-d17d-4731-90d4-cf7130d107cb", "sighting--f349de1b-4219-46ac-93a7-e16f7b75749f", "sighting--54feb3af-0cae-4c81-8bcd-4ad8c7a2536b", "sighting--7ac5fc0b-34c7-4666-a37f-d791f4886cc8", "sighting--a23af3be-c129-4522-8121-eaf6b3d756a1", "sighting--18bdd98a-d558-4398-82a0-b8817ad7ddc4", "sighting--62c2963f-241f-42f4-8787-28eec09d0804", "sighting--6caa5db1-47d1-4021-b85c-e9074f7ad6c0", "sighting--877f0e49-60b0-4e99-bda1-ebac8213cad6", "sighting--faa05b3d-ea56-41e3-9475-55ce0354f3d7", "sighting--debc3088-5fe0-462f-8a97-c3292b8c3cd6", "sighting--3c9daf62-151c-4007-baaf-1457f1518aac", "sighting--116a4116-4082-41bf-bdb5-bf8ca9a2de9e", "sighting--355ba7b3-0af8-4c40-aa72-dfd883f96154", "sighting--f05debe3-da9b-48f9-8616-a597a2e43a15", "sighting--666ac092-24c3-4595-a85b-c901d43887d8", "sighting--41520b98-e7d9-407b-869f-525d9a23942d", "sighting--70a1e8fc-8ee7-43a0-af44-be7efc1f1759", "sighting--09829063-ac4d-436a-afb0-3aa51059c71f", "sighting--fd45db0d-a3e7-4558-9dce-3be511e51a77", "sighting--3f3307aa-85e1-4098-bebb-3e0bb23207f6", "sighting--7ab42b05-0c6f-4390-9604-f3496ab4310b", "sighting--5a04bc9b-c2b8-4270-8723-fad5bdb83817", "sighting--278f93d7-b1e1-4f69-8915-dc8dfaf55412", "sighting--ab4bd6b6-ad14-4a54-986a-d59551822456", "sighting--07147489-b177-4b4b-8d34-66b92008c00a", "sighting--30f2bbf9-861b-469d-bff2-f88bd6396a7a", "sighting--200f4907-2f03-4a88-a68f-99034500edd2", "sighting--bebc3bda-a7c7-4734-871b-35e8809044a7", "sighting--74bf57c6-ec4f-4e19-93d4-78c3f679f91d", "sighting--f78c41db-73e8-47d8-90c6-572b311af7b3", "sighting--cff9b028-ec7f-49ef-861f-3f50d42f1adc", "sighting--0b6568bb-310a-4bb5-8ade-64bbf810f36f", "sighting--73788d32-ecbd-43b9-a4f0-a426d7472b6b", "sighting--80a0ec82-b370-4a18-95c9-2e7b38b71da6", "sighting--a8e14cdd-9b96-4f44-a878-9833137ff5e7", "sighting--58b43544-dd7a-4416-bc15-8307cff7c24b", "sighting--b89d9256-9e05-4c55-86ee-c87778dd00a0", "sighting--6ea3a52d-4e01-4ad3-87d3-fe34d1750dad", "sighting--83785eb9-16e0-4c4a-a757-c85bb21f8294", "sighting--6f628c09-1706-4f84-8b2f-8f0e02023ce6", "sighting--1dd31069-f6f3-45d9-b35d-8c1ebcef0ed4", "sighting--f8738ff0-b0f3-484e-8546-53c3b5b89cc8", "sighting--4c9e61b6-6790-4753-bb57-5d292df82c31", "sighting--ec81a877-689e-4948-9482-8c0ca4eeb2a4", "sighting--16bfbe95-5f35-4689-abf6-3c6c4ebc23d4", "sighting--0fff0ac5-ec45-456f-97eb-05b5a023a553", "sighting--e6d8e6e7-bfb8-403b-b97b-da93d8603ea0", "sighting--c5c0a5a3-1a54-4386-bb6a-9b04584ca11f", "sighting--5ea51a9f-02ec-4809-bef7-349991213a99", "sighting--80571837-7665-4284-8181-38f08cc7f610", "sighting--ca7e39e2-a39d-429a-8d6e-b6a8cdacca23", "sighting--96d3438d-5710-44c8-b972-67e9966ac244", "sighting--10800600-6889-4cc9-9638-7d368fa837fd", "sighting--106bd33a-866a-4352-aabf-88ec01b74281", "sighting--523afca8-e5b5-4865-ae15-ce53c3c19dc4", "sighting--5bf94a6d-c6db-40e1-9b51-baa902f9905b", "sighting--e5379fca-511f-4dd4-a6e2-330af0305bf3", "sighting--e6691dae-7b1f-42b3-ad92-e9d4024a84d7", "sighting--38a4e89f-b688-4e81-83ba-ddbda3adc363", "sighting--b1075d7d-7135-4add-9667-fe7dd46d387d", "sighting--eca6831f-696d-4db3-ba62-e57ad29b698b", "sighting--f6de3adb-e265-4d88-9ab8-875c43c3ee37", "sighting--2130ac68-de3a-435f-b2a8-f034a89028e5", "sighting--9d4878b5-d8df-4ad0-b924-4ed6ec47af3a", "sighting--cbad1b61-51fe-42bd-834d-92301daca5c2", "sighting--c94ea3bd-c804-42c7-84dd-fba999f84ae3", "sighting--f0ec1c6a-4f52-4343-9841-1bdcf0cf0f0c", "sighting--2e059083-6908-426c-8246-3723e32af732", "sighting--fac9efe4-9df7-4514-a320-35ca39887873", "sighting--892c000e-9c65-425c-97af-9605e449a1c4", "sighting--ba319c4b-be85-4321-ba21-c547c7651504", "sighting--8a175467-01ac-474c-9912-d498a233c8e2", "sighting--43bc5941-8ce6-4437-9c8c-989aadf5acd1", "sighting--6f7f2fab-155b-4f11-9376-f769a3dac1e1", "sighting--3a2593aa-e0c0-4cdc-878e-7f178ac05ebb", "sighting--d18f3a57-babb-457d-987d-dfcf4e152b74", "sighting--4328e6af-0252-421d-8f8f-87ba3b37b4d0", "sighting--3d0c04cb-5b24-4011-87fe-a65ddc702efc", "sighting--39eaefeb-c4e4-4362-9310-063929f496f3", "sighting--6e37b1dd-552f-4fcc-99ce-d07143ca855f", "sighting--d7eb1185-648a-448d-9104-eb8dfc129052", "sighting--071a3c69-02d5-4ed7-8ed0-19549cb4d191", "sighting--5b815089-c569-4b9b-9efe-5ded22adb1f4", "sighting--95c354c3-c03b-4f4a-a05d-4adc33f835f0", "sighting--a68e98bd-241f-4349-ac4d-2a4556ca2869", "sighting--1215a020-4ae8-4a33-874e-d376a25ad0b5", "sighting--e5270051-b5e2-47c4-b9cb-619e1bee9fc8", "sighting--87591348-4219-46dc-98b8-06378fb45988", "sighting--69235fc1-adac-4c59-8800-4245e9511222", "sighting--60b3b9dc-4f13-4587-a4e8-cd430ed52d9c", "sighting--07a74def-2c25-44a6-af54-a14bd99f56fa", "sighting--1885290c-93ef-434e-a2c3-31e8199a9a0c", "sighting--0b611b77-f297-4810-9bfc-c3b674876178", "sighting--51d435e7-99c3-4c5d-9f68-3869ef3864d5", "sighting--31d33cde-61ad-47b5-a9e9-78843b62c877", "sighting--988033e3-ea98-4134-99d8-164cf36de974", "sighting--b4545233-668f-4522-a83b-3c4f675a1ada", "sighting--5c36a628-7a9d-4fb7-98e0-476086e14e56", "sighting--a79cd024-f610-448e-8faa-ee8ceebf86b7", "sighting--719faf06-d37d-4445-a421-d1f139dd0380", "sighting--2a32123d-8d5a-457c-a081-ec22577adf2e", "sighting--0c3a04be-4962-4d58-a72a-9fde4fa4b903", "sighting--adbfaafc-10aa-4454-bee3-f4df39492fd1", "sighting--57616898-935a-43af-8bca-7f554efbe7bb", "sighting--e0924e03-6eee-43dc-b1e7-87e71335f7a8", "sighting--f72cc0e5-7a4b-4deb-89dd-eec365d0c977", "sighting--21d6ef67-09b9-4d93-8c3b-b420f59f0d33", "sighting--eff6847e-8dbf-43e4-8f02-42b6f4acf715", "sighting--6e09d42e-6367-4846-b4a0-da87fb8d68fd", "sighting--0dce4457-8dd6-4291-889d-1619876ecaa2", "sighting--e15b992d-7a61-461b-9aca-5db1d0284e21", "sighting--d9f5a71e-cbea-4fa9-a821-676a3ce3b3a1", "sighting--7f20939a-fed2-4195-bfba-b431c3adb598", "sighting--8ad55b72-b0cf-4667-907f-2eec02887909", "sighting--2be08492-1ea8-454d-b4a3-22d05aa0b790", "sighting--5a101fba-47a1-4216-9937-b1f1a93b7545", "sighting--ce1b9d5d-822f-4c47-b92b-f77aaa5acb9e", "sighting--15505618-7243-4c42-ae42-89ff5ba527e8", "sighting--108866bc-89f6-45ff-8b8c-794011c4d007", "sighting--32968041-ceee-4d32-b757-0c996898e745", "sighting--24d1f6ff-bcb4-4de8-89fa-36e885247048", "sighting--3def47e7-de7e-4252-8af3-1333913e6e3e", "sighting--b12c28f9-c8e7-4b0f-90f8-1974946313da", "sighting--63a5d80e-3b9b-4d9a-b735-8fa278f3e34c", "sighting--24a65f40-9e49-4f58-be31-253e6777ecff", "sighting--7b3dff6e-a6ec-43fe-bde9-faed806e1e73", "sighting--4afdf53a-0e7f-460c-9f19-9ccd6b3763e3", "sighting--de36f1c5-e963-4351-9ff5-779bae7c4d07", "sighting--671d95d7-980b-426f-8a77-26c3045bc485", "sighting--cf1e1a21-196b-4bc0-86fe-df5b9fd6508e", "sighting--e9e86132-93ae-4e61-9dd7-6dbe2e336a71", "sighting--232ca418-2877-4c61-95bc-74d480eb318e", "sighting--8a5ea6be-668b-4427-a423-742bcf08c677", "sighting--d3ae3315-bccf-4c67-8455-e033f45e1fcc", "sighting--0eeaea93-2db5-47ea-bacf-71cc847bf59a", "sighting--28a22a8e-a85b-4622-a689-adb38b7294b6", "sighting--d9ea55b8-770b-44d3-9df3-203db4712f91", "sighting--f05e81ff-515d-4fa1-829c-36c2f0970c2c", "sighting--425e2d87-7033-43c9-b5fa-7050610c4178", "sighting--51961c1c-4e2e-417f-8c8e-fc32c8d68e1d", "sighting--45dc642f-1c30-4061-9adf-4d31e6457283", "sighting--2f2d145c-fe72-4a10-9880-b7e86e55717c", "sighting--03bf26e7-9767-4a19-8460-cdea78ff31c5", "sighting--3a93bcb6-f1d5-4954-8ae4-18c38c5704c8", "sighting--8d71e761-d8b6-4936-9960-6bf1776780b3", "sighting--ed206655-b14c-4566-8042-5d78ea34af0e", "sighting--a799c3fd-d384-4005-ba32-de97c4e4a664", "sighting--c939a1c6-457a-47e6-9641-bce8df671659", "sighting--9244455c-12a6-4b0c-b788-b50d49595496", "sighting--39e486af-7dce-43f1-9dce-b567143d666b", "sighting--b1f47996-d6df-4432-a7d0-be5f513215b3", "sighting--a46c4127-3c1c-46bd-a9ec-d40ed2b3240e", "sighting--476b2c7c-f174-4c48-8d11-50751a92ea82", "sighting--76922386-c4b0-43ca-9a24-a04e4d5e7325", "sighting--42e82867-f56a-4068-bb86-d0cf624569e3", "sighting--07734d62-6fb5-4d6b-9183-318268d3d8fb", "sighting--e8de55e4-32d7-437e-9634-b60607e4b8e2", "sighting--acff1b5c-5852-4b06-b0df-cc84f4cce95c", "sighting--8d768666-eee1-47ad-aa4f-07d82560ce1d", "sighting--ff9dd2d2-1287-429d-b22c-005eb8545588", "sighting--a0856308-6946-4793-89e5-cc0aff45b36a", "sighting--b5e56c07-da2c-442b-97b5-2dfeff312b30", "sighting--4be313bd-4dd1-4b8e-afbc-17f116b0dc5a", "sighting--6de869b9-d68a-4043-b75f-b0e71445aca6", "sighting--27eb711d-7542-409f-ae4e-03b06be3f885", "sighting--5996b4f4-f842-4a26-b190-2da7bfdad952", "sighting--f9bd5a2b-18c1-4c38-b7f9-2c7eaf6e7089", "sighting--4f9c6e0b-f243-4c50-a1b9-5c05109bd855", "sighting--acf0a0a9-b100-4773-aa18-9c4f0c0c8448", "sighting--0750828b-2abd-4e8c-ad38-aec68b3b2752", "sighting--46cb7bba-2f18-4931-96a8-47249fd3b3b7", "sighting--ff24e1cf-c78b-4245-9a8b-7dc482d26b5d", "sighting--bd903ffc-9074-4179-8c10-e67f9cc23956", "sighting--68991eb2-17c2-4f27-b44d-6837f760bcb2", "sighting--9ef2499a-ea6b-4c39-8c2a-047295051ea5", "sighting--b4ae1932-026f-4a9e-87b1-95a212ef60b4", "sighting--001e5292-a621-444c-b92c-82fc76646d27", "sighting--515c7f3d-858e-4e26-9f3a-e5fc3e4e740d", "sighting--ef8a5270-94f3-4332-aa9f-fab949c406c9", "sighting--68eb511e-0845-4c3e-9a71-b231af78623d", "sighting--d1f19568-ff68-4404-b0b5-0e011870f937", "sighting--7f718b57-a19e-4c6c-abb7-e28c92a1a1b7", "sighting--26542bd1-dd62-4f65-b906-de35fd70c1be", "sighting--32886ede-4e39-4f72-8bab-f3df89999bb9", "sighting--aa50fada-88ef-4781-b6da-c0d6b2f0019c", "sighting--eae84ce6-b5ca-4beb-bc3a-02229aff654b", "sighting--cc115cf2-8599-421f-8f5d-d9206692f45f", "sighting--717a8f3b-1505-4163-ba8b-ec7ba193b337", "sighting--b42ca026-7e66-4d05-8cea-00e2e10e2dec", "sighting--000dbf67-136f-4495-bee8-7afbbea82e6f", "sighting--27b3e547-73a4-4b0c-a058-3b6c2eb4a6e7", "sighting--90234e20-122e-4d29-af3f-831554a03e2b", "sighting--879ab22b-ff56-4df4-ac07-e52c8386b8a4", "sighting--b83123d0-9ab7-4f35-851d-84cae8d2de91", "sighting--a57533af-b9b5-4796-acd3-8d5750b8ef29", "sighting--333e81ee-d67f-4d1d-abe5-de4e5fbb82db", "sighting--70188741-8084-455e-9e4c-55a866a4be71", "sighting--07774807-ebc7-419a-a063-b2d9b14ac673", "sighting--87653262-382d-45a9-99d6-63d8e5738e0e", "sighting--4edac1ff-2f53-4306-8389-7ff5c6042fef", "sighting--f7c6c372-f888-4177-ab15-be8a357c1d2d", "sighting--77bcf551-f3c7-40a8-ab3c-6e89d7d49f79", "sighting--0ea437e9-5b3a-4f66-8dbc-91bef8aec0d1", "sighting--68fd84ca-7c17-437e-9b2e-560b07b0b5ae", "sighting--47bcc2b3-4ec9-4848-a275-3aae05fbd142", "sighting--cb47f463-9965-4684-a88d-6cda18c90717", "sighting--9f163598-18f1-429f-ad6f-1e120fdb34f0", "sighting--57a9266f-0e9a-4c9f-acdc-24dc3804ada4", "sighting--7c25a941-368a-4f0c-90bd-03d5f7558f48", "sighting--f48241da-3480-49dd-bf3b-efcfc8d484d2", "sighting--06cbb827-a404-4582-a293-f2d2d4602ad9", "sighting--4e4df952-972e-4e3a-9d37-795cacce6e1c", "sighting--9cb82f8a-e270-4d6a-8ec7-1f2b099a7e45", "sighting--b3cde0e7-65d3-4c12-ac44-7f38cafb759c", "sighting--d7c577b3-709d-406e-9cb1-9e2f5bce5d0d", "sighting--17bf9e18-5f0c-4722-a9b5-a9fc183db6eb", "sighting--53cc5fe8-36b0-47ac-9143-89daf5a73772", "sighting--f538242e-f774-4d02-9efd-751c574363f7", "sighting--ba97b0b5-223e-4902-bd98-e6d2a47f660b", "sighting--8e303414-cc3e-4440-aa1d-6b4a5b067f98", "sighting--5fa12532-e62d-443b-8afc-7706fa5ae763", "sighting--6b9a4b90-d833-42e4-ad0f-edf56d7fbd93", "sighting--18320c4b-d494-4777-9f5d-2a0a469fd5e0", "sighting--3f24b1ab-d1a0-43c6-afd8-e649629ba158", "sighting--570be7ad-41ef-4541-bfb0-4bcc43b39908", "sighting--d654a78e-5944-46d2-9356-d99a211ebe58", "sighting--0147d034-1c5b-42cc-8b5e-2f5e5ecd7730", "sighting--e3cce2d5-d3ed-4aa6-9bc1-8c3bda0954db", "sighting--35a8949b-2946-4be0-9b92-08411b4680aa", "sighting--606753f7-1bc4-4ac2-a785-ff17ed955fb1", "sighting--2e8767d7-8ac9-4b7c-9c28-b8e269bd2513", "sighting--e26e4098-9887-4ae3-ba88-0bda04ecea88", "sighting--1fc7e9e6-2e4f-4942-861e-d54b1a22fc8a", "sighting--e9f24591-f527-4d63-bed3-f3026c59915e", "sighting--31216194-438c-4d07-915a-2afd5eecc9e9", "sighting--fb7fe308-a225-4da9-b7a8-705746be3a67", "sighting--7318bfaa-8f0c-4610-8688-c86299c0115e", "sighting--4673a48b-eb7e-4126-af69-1978819f6243", "sighting--51c2aa60-c97c-4db4-9e0d-fea2110bfd96", "sighting--e0c419f3-283b-41bb-85eb-4c5ac4b1db0d", "sighting--586194ee-95cd-45e2-97c5-7622bbbc68c3", "sighting--7bf117e3-083c-4c9a-bc4c-52898498c7fb", "sighting--25e9d28a-2988-4b0d-9038-d7939af6c9e3", "sighting--0c3927ef-8694-4aef-a560-5fc97a1b6049", "sighting--b7720efd-6017-4956-a76b-43b1cbdce491", "sighting--4d8495b6-0d83-41a8-8615-d3daa72c5682", "sighting--edbb4fd3-9214-4656-bd85-cdfec477c16f", "sighting--064e3a39-8868-464e-9688-bf0a7c4f910d", "sighting--fbac2a86-d0ec-41a7-91fb-fbc579eda1c3", "sighting--a849d0d5-de81-47a4-8679-f229f775af19", "sighting--3786eaa4-0922-4ddc-b013-1e1c4d55de3a", "sighting--a90e7c5d-4cac-4114-8d81-13759be38de8", "sighting--163e1dc6-a196-432f-abf4-0f2fa3db1e29", "sighting--ffb6b1ac-6666-4c13-b129-7171acc8bd20", "sighting--c780b6c1-bcf7-41da-890d-7899350d3e5e", "sighting--78288850-e763-4e50-8415-205ef2cc0584", "sighting--0eb79c07-0713-48c6-98d2-e971d2768516", "sighting--4c05d661-06a4-4066-a213-238fa32b686a", "sighting--0175d999-d758-40f0-ae1b-f79c4bd7e4e9", "sighting--f6396d98-0a64-46fd-a232-49cb96622033", "sighting--cb129c15-385e-441f-9a80-4d1651330efe", "sighting--2a2f9a9a-d83b-467b-8853-779fba755b8d", "sighting--5bb78fd5-4e40-4caf-9f15-a4dee057f58e", "sighting--e5687676-80fb-4a37-8513-9647b5e88421", "sighting--b75b2b90-f4cf-47c0-bb5e-70362aaae331", "sighting--d2bffe5e-e929-4750-bffb-81a55a573331", "sighting--3fd4e58a-506d-4eb2-a3a2-952ac28cfb7c", "sighting--42d01e3d-197b-4d3d-ac73-361643a2a305", "sighting--0e502821-8bbd-400d-ba4b-7fad7cbeb6ce", "sighting--e47d3b0c-913c-4e95-9308-a9153426d766", "sighting--8f74c680-2125-4f86-bd85-40e77d54c7fa", "sighting--ba386a53-1aff-474b-aa75-ba6ea842eec5", "sighting--03606e02-e86c-4f1c-b8d3-19dbbd320858", "sighting--3d3737c4-a910-40e1-b2ac-14fcd25bdb95", "sighting--f1c21ea0-6d53-4c5a-a9e4-bd84fa6154e4", "sighting--da09777e-255c-4873-91b6-01d3734d125e", "sighting--573d76fc-3631-4bef-adca-4fe679565849", "sighting--5d542f41-027e-48e1-8b0a-4c236317721b", "sighting--16708a8a-254d-4179-b84c-04ddfd86f0a7", "sighting--27b13551-2bbf-44b3-bb0e-0ec7b3167a97", "sighting--d32cc283-aad4-4848-b883-040a9b04dd36", "sighting--e992a8f8-456f-4200-b097-caff0d1f8972", "sighting--80161581-275d-442b-9af3-b1864b543f75", "sighting--0ececd3a-5a71-424d-b3e5-983625faee5a", "sighting--8597e7b7-7d47-473a-b687-7efa1e102fd7", "sighting--e3877a52-0dc3-447a-8f8a-38a553708e72", "sighting--b4d033b8-979e-41ea-ab4e-42ffde65b8c9", "sighting--3cad3ec2-8d89-4830-a416-d9765fb26566", "sighting--2acbf7a0-6782-45c0-b27c-217c1313a856", "sighting--51da44fb-0bf8-476c-b89f-6916f0ecf529", "sighting--0d9b4fb7-7fde-4389-a2a8-a1bad21f1d18", "sighting--74d5a2df-a24b-4c23-a6a6-7b70c8a47e45", "sighting--73f2fddc-7f42-4f73-8f1c-ff2c8ef0f625", "sighting--7b33194c-b157-4a87-9de2-12607a9d3864", "sighting--8cc3faa1-10f9-4eaf-bbce-fbeb50a4ff35", "sighting--b4a171f1-7050-4f71-aefd-60ccfef8a9e7", "sighting--72fe396a-8023-4f1b-9169-5453d5826fda", "sighting--78fda34f-ceb5-4638-9abd-b0b5e45c6d5d", "sighting--d56acbc7-30fc-4d07-84c1-2f76e1a7edaf", "sighting--3fe453fc-ae20-41f0-8150-e7089ba5a892", "sighting--e3ef85e4-f3f0-4900-90bc-553331ea5234", "sighting--93db6b49-c31f-477a-9467-825a08978cc3", "sighting--a961f682-ed44-4138-aaaa-6aa174756b2e", "sighting--60826336-3819-4c28-a654-aef8e812c74e", "sighting--cedcf625-9951-4046-812a-977cb6dfffe7", "sighting--461d85de-5cf6-4bca-8d63-b007d0de91a3", "sighting--6a65950d-219a-4409-b3f0-51f178ac51f7", "sighting--dd223c18-5627-4e8a-9fb9-4804d628cc31", "sighting--b363129c-d82a-4ab2-97ea-3816135822e1", "sighting--667164f8-dc3c-4f48-becc-0d3466582281", "sighting--0c3d56f1-8da7-4407-a447-708d8303badb", "sighting--3bf6af5c-454a-4624-8244-e6a6bfb92281", "sighting--16bae6af-9551-45e1-8aae-a4d9c0547dc8", "sighting--affd6f0e-324a-477c-b016-c5ef02e6c47d", "sighting--c5a96842-c0b1-465e-8914-88f9cf7de82b", "sighting--49a38ac4-b27a-4646-89f4-60125cddf5f8", "sighting--4c11e80f-f31e-407c-a40f-e5bf2d896f42", "sighting--5c2495b3-20c2-4993-8bc2-17d429b0e405", "sighting--4b79fad0-b5f3-462f-a958-c5efe33a76bc", "sighting--7e019ea4-5d42-4ef2-86fd-4ababe0a6571", "sighting--937784f4-0361-40d3-b1bf-af59343c2c0e", "sighting--12797552-d020-433c-96cc-3190f0979825", "sighting--6812a2cf-ebcd-43c6-8dcd-7d4dd7876516", "sighting--20df2470-d112-4903-bcd5-d38c1de18d53", "sighting--b16c09ab-b2f8-44ea-9786-82662ee3d5cf", "sighting--516ae1d1-db54-41b4-af3c-ae52369b1776", "sighting--04987453-567d-402e-a9b4-34c081ebaeb6", "sighting--b930642c-3efa-4c58-8542-1280e1ddd2e3", "sighting--baac47e5-1525-439f-a46c-077f04be6557", "sighting--e3bf9b13-0473-4da4-a025-f95c1d342e63", "sighting--6542d980-dbd5-4f63-bb2c-f88d05547e84", "sighting--7c939376-56e6-4048-9123-18c6b208cbb6", "sighting--841893d4-6abb-418a-b97f-9ebcaed48862", "sighting--ee54aa6a-9c0b-4961-9c9d-4aa112811d95", "sighting--dad3ef38-438f-4907-aed5-cba70b43faf8", "sighting--9e3d25e8-68cd-4706-9b45-81767e006de3", "sighting--cdcba21a-874f-423d-885e-4dfcb9cc6914", "sighting--38c57cfd-df5b-4159-8ae1-4660568f5b93", "sighting--892a8c83-97fb-4f8a-aa2d-0f4f9ad17d02", "sighting--b2a52069-89c5-4dd9-af62-1c039cac8771", "sighting--defffeb9-1bcc-4ba6-a446-7cbf275ad4c3", "sighting--f3c49e3d-6393-47cd-8582-d9d6b189a6c0", "sighting--39edf7d9-eff3-4236-aa2e-bb165f347b30", "sighting--3f90b74d-76a0-4de5-aed4-411e5113f13b", "sighting--0bbfd0d0-2e1a-4c85-9fad-6197dfbbfab2", "sighting--c84debe4-ca7c-42be-adcb-02a68db72e04", "sighting--f58c8eae-9eca-44c8-b227-c81aa18a624d", "sighting--9b3eb7ad-c3f5-45b8-a68c-e7542e5389db", "sighting--b334b71b-af7c-422b-a910-d1daad3c15ee", "sighting--7d228a20-e6da-4726-989d-b456c845a4d3", "sighting--3141bbcd-ad8f-440c-8be8-b056d4c002ab", "sighting--bc881cff-f878-4091-b8b9-47b41f5877af", "sighting--1526a627-1af2-4b62-992c-4f3385bfdf6b", "sighting--b84fa149-e06b-4099-be47-c25161879ed7", "sighting--6cb91acb-2d53-4c74-ad46-11b54d5c5ac1", "sighting--f3630ecd-3268-412e-8331-2b19658f209c", "sighting--00a7a649-1b43-4610-a0b8-76e548463d2d", "sighting--be3f0d24-a04a-4c68-b212-51b6e3abf335", "sighting--0ec0c037-158a-4043-bf2e-9a9f076a91f9", "sighting--3f386378-f94d-4fe9-aea4-e0018e536e8c", "sighting--6182cee7-d156-4051-9b30-b59651bf5df8", "sighting--db9d66ea-364b-420b-9b7a-27ba4251031c", "sighting--e0f9fe6c-cfbf-4827-98c8-93790d2eb888", "sighting--df8191d8-7275-4bfc-90d9-1d612cb8d32e", "sighting--34f60462-f724-45b2-8357-5ccc4e14a71f", "sighting--8c859aa5-d0aa-4a77-a5f4-64077a4dcebb", "sighting--e936b01d-2af8-48bd-bfd2-2db9b513c92e", "sighting--d2e6a25b-40d9-44ad-be0c-336b41586b59", "sighting--a463ffea-b846-490d-8530-360405579cdf", "sighting--e707444d-7643-44bc-9809-129e189a7f06", "sighting--63b1933e-65c7-4df4-9ff6-3d095af08b6e", "sighting--6b9c3de1-a573-4a53-8835-ddb846fa0b71", "sighting--d120704e-1832-4c4e-be5e-d83f69b4519e", "sighting--326c6822-1142-4de9-93c3-fdc5cb6ba93a", "sighting--3fbd1cad-e449-4180-a524-e94d4de09154", "sighting--f3f5aaed-741a-4131-a50f-5a0b93ddfe23", "sighting--5b1bd5bc-39a9-4ffa-9271-5827434ad552", "sighting--d363596d-1763-410c-8553-931d09b22cfb", "sighting--2c38cc20-3cee-4ee8-9b4e-975d3eb3b650", "sighting--724223c7-ecce-4054-a85d-c0bc20bffdfc", "sighting--807aa61d-3686-4d8d-b8ce-a2ad951409e5", "sighting--4c5e80eb-d4d2-4847-a29e-90988b61655e", "sighting--52a023fe-f17b-4be6-9d7c-affe7d08d0cf", "sighting--11a9b52a-edca-407c-80a2-1f9e7aefa69d", "sighting--f0592203-1bd0-473b-a381-deab5871c5b5", "sighting--64dd2d63-73b3-4cee-82d9-6fd1841a2b76", "sighting--434581da-8e02-4a39-a77e-ff64a9e44689", "sighting--ec644aa1-7434-4f02-b63f-cfd2727f3a55", "sighting--bc6bcfe7-ae22-469d-8cbc-f9980a55e412", "sighting--7fc6f0f3-00c2-41b3-8c77-2213efb71999", "sighting--916a1a22-ac0b-468a-bbd6-c07dd592b1d8", "sighting--cd09afb7-0ed1-46dc-ba50-9026d2b70b07", "sighting--7fb300b4-5c22-454d-9449-6e2ba2083fbc", "sighting--c1e1a5db-fe33-48d6-980d-9a0490ee432c", "sighting--a4c9b71a-01fb-4fd6-a19e-9ebdcd0c77e4", "sighting--95991ea1-5fe0-4d46-8268-5557c92e1d65", "sighting--1209e3ee-9294-4e2c-a790-d5235dd54e8d", "sighting--d10e3818-f90c-4566-a20c-f34c6a59fffc", "sighting--b9be62ee-0275-49f0-b11a-af224bd48920", "sighting--92da45d9-8534-41d9-93b3-4e67f0227ce1", "sighting--75763178-6139-407d-8373-4b98586070fc", "sighting--f42ba4e3-4a4a-4785-b0e7-df1e4db2a321", "sighting--3d7a0498-7cc3-4465-bc68-ed6d656487a3", "sighting--86f043f1-ff4e-44c5-b737-4117f7286446", "sighting--a14eb2f6-601d-4763-8244-dfd6ac609133", "sighting--6db66a07-5465-4e18-9ed4-cf9cdfb199fb", "sighting--fffb371d-6267-4f68-b2a5-6b799029e889", "sighting--045eb19e-6c2b-4889-8f56-d6b8a8ae76f8", "sighting--871c8ae3-abfa-4a5b-96b2-6cfa3c2720e8", "sighting--727ed713-7114-4d37-9482-861ce59d99a8", "sighting--f97b6652-3e32-4a3f-b91d-f9a55e6002ca", "sighting--4286fe13-8b4a-4161-bb30-a238e19da91e", "sighting--550b10ae-5a00-4031-8f9f-bebb3ed3abbe", "sighting--b36e81e2-af12-4019-9ead-3ebdaf69d23e", "sighting--0f049c11-676a-4bb3-b5ed-4b111eb58f32", "sighting--84bc0eac-0fa5-43ad-9d49-e77a7204c934", "sighting--7c8c23c6-87ab-4196-a649-75bf0b0d2ded", "sighting--c520ac14-50c9-4557-afc7-374f888a95da", "sighting--c03b669b-b46e-4dc7-a074-bcbb717a17a5", "sighting--9eb2063a-28ed-4f89-8424-066155826e89", "sighting--513f6a93-1225-4795-83e7-14a56c4ffa1a", "sighting--b9f3a3e5-90a5-47a1-bc34-1fd66eca677f", "sighting--e439e3bd-d1e6-4d2e-900e-4a416f055f26", "sighting--5f91c42d-7ea8-4ff7-b8c1-bfb19c83b9ae", "sighting--db49c261-6dd8-4fef-a9c7-6ebc26979817", "sighting--7df87888-7c01-419c-8978-1b35393e5f62", "sighting--9143eddd-6df0-4a05-85b7-cec514e91bcc", "sighting--25a078c3-cbe2-4714-b93e-7374ca2f6ebd", "sighting--a6707859-379a-4f45-ac5f-7f558def4adb", "sighting--642f8001-0b94-4c7c-9e37-1fab303e0864", "sighting--d77107a1-56ce-48af-8323-12bf6283cbd8", "sighting--b0c14861-6993-4f83-92b3-4c2c5bc69a84", "sighting--80cde865-1438-4767-af91-ca8cb9ef3695", "sighting--28256bd7-ba01-48e0-b3a9-5b6db6203be9", "sighting--7fa0ca91-bb3d-4d3a-ae68-83885b85d34d", "sighting--e2104cc4-e505-441d-a32e-b2cc063a4066", "sighting--75675170-4d7b-403e-8067-3118e032f531", "sighting--b8652518-44d2-4a84-9fc8-f9ef96e66519", "sighting--26875bb0-7d77-48e4-9a35-21bf58301938", "sighting--3cc895dc-c720-4989-8d98-c8f015a04953", "sighting--d390766e-2fd7-4033-8da0-67e87c50f999", "sighting--05e4c2dc-a5c0-4d7e-ae1d-cb37fa14cfdb", "sighting--2764df32-2f7d-46fb-90b0-ec20afd11b45", "sighting--ddadcfa2-0eba-427b-a88e-cd4bdd235b44", "sighting--04b22dc2-96b0-4d15-a37e-7433361c8beb", "sighting--fa5c06b5-6320-47ee-ab46-295b2560270c", "sighting--2bd3859b-e3c0-49ce-8e90-e3ad09b57848", "sighting--1f70dbb6-908d-4cd6-a3c6-a44f739ca538", "sighting--70df4414-a908-432a-b5fc-e4882f2ce8e8", "sighting--2c258ff9-d388-4dcf-8b9e-03450f3ce238", "sighting--5ca31ea1-199f-45a2-ba30-9096a3af2220", "sighting--f8169796-4894-4048-8966-ed197e1def20", "sighting--62ded974-06f5-4a17-94dc-73eaee7f9647", "sighting--1ec90f08-5555-46af-8aa9-3d13698c3205", "sighting--09f3b635-46fd-4622-a62c-988884ef48e9", "sighting--68dedd69-6113-4f73-87aa-539f9a647a9a", "sighting--869c3ad5-50ba-4337-8d52-44b78fbe66d4", "sighting--7054d826-6e84-4d74-a130-853cd7ecd83b", "sighting--c7960251-d8fe-49c0-8df5-4e8cf4ec4eb1", "sighting--194b2c6d-93e0-4a66-b75f-60ea5310e8a8", "sighting--204c52a5-d68e-47b9-983d-8ebc4cf3259a", "sighting--14d63cb9-751b-4326-a915-486269deca67", "sighting--f9d3bcf8-c1d0-4b7d-a0e1-1a55ca48ee5a", "sighting--8132d498-5e16-4a4b-8282-d5872dd16c5b", "sighting--e90e6ecf-1f8f-4ef5-b72c-ae32935162e3", "sighting--1e470d24-489e-4c5a-b573-fcdacea33cfa", "sighting--d51eca2f-5c9b-4a83-a516-8916052b5fd7", "sighting--6d8cc166-12bf-44e8-8e6c-ca93fb4573ed", "sighting--47c959ad-3587-460b-89d9-f1f50c522d6c", "sighting--a88252b3-2cbc-4fa4-abe1-256f6655c4b8", "sighting--729d9103-9317-44b2-94fe-9f12e2361d8f", "sighting--c868a15c-27a3-45cc-a931-191a422ca07b", "sighting--d2ab5461-1044-4deb-b937-d07804a878f7", "sighting--536a6059-4c32-4a29-a16a-8f1f576d2ce8", "sighting--437b6904-5df4-4192-a37b-ad173df80a76", "sighting--e7253bdf-0638-48a9-af8a-da53f187d61d", "sighting--14183cf5-557a-4f7a-8a03-dcaf52e809b6", "sighting--cd665f91-1ca6-4a24-ab64-24c1ff92c98a", "sighting--9995207d-2b2e-4dc9-bffe-d41b9271138c", "sighting--f1b0ec65-a47e-42be-a0a9-ffb945eb6817", "sighting--bd7adfba-d311-43e2-ab06-d1163516d107", "sighting--de1f6199-d361-4edd-bcb3-c0ffa97b8c2c", "sighting--d608bac9-7e85-43c5-96bb-85d79f6398ba", "sighting--452913f0-ba79-4b02-b11f-d7a794c5e3a8", "sighting--8ed0267b-7a94-4eeb-bb39-8fbf9697cd9d", "sighting--8f373bf5-6732-4d1e-9602-ccb953e643c4", "sighting--659ec569-a5e6-4733-83ba-39ba5e346ea2", "sighting--1c879a7c-ac81-4c5d-bffb-a40820eb675c", "sighting--eaf6f671-c55d-435d-8518-755351dc3cb7", "sighting--523d8897-15de-41b5-afc5-b9da8b74744b", "sighting--936a2d12-dcf6-4832-8d39-e9c78ed2c8a5", "sighting--eb9912e4-75a2-4b8b-aac7-6b94b84daeac", "sighting--fc63c225-1fa2-482e-adc4-476b083ea5a3", "sighting--6f74f079-c20c-4e19-93d1-4200b9e6df9e", "sighting--eb1d06fe-5add-4cde-8672-04c0b36e44b2", "sighting--f30ef9bf-5061-41be-aa01-0155c0d68059", "sighting--b04a6821-a225-495d-ab38-015e71ea977b", "sighting--15e1b094-8622-427f-b985-bd97f7615bf4", "sighting--832e66ec-7949-4841-9723-3c0784c70e15", "sighting--947ca314-020a-414e-b779-e165d0a95193", "sighting--726ec7a4-ef06-4d73-974c-c43586b54033", "sighting--bd19bbc0-d841-486e-8c05-f5e93b4a364f", "sighting--c1759c12-3769-4174-b5b0-0a479d023878", "sighting--23f12710-5232-459f-b4c4-57b11454737d", "sighting--dd517cd6-198f-4fef-87b4-bf635dae2216", "sighting--65dca6c2-e504-4631-a080-3a376300333d", "sighting--99711d3b-c473-45aa-bc1e-d26ac84c9cb2", "sighting--72bfd6fb-0ae2-4547-b37b-e2e02a3264d5", "sighting--366ba337-f8f6-4811-90ae-ef73b2ac6b44", "sighting--4fa6e311-aa18-48f7-bcaa-6b875e131871", "sighting--05c0990d-97a0-4cdc-a712-0f73f1fbb141", "sighting--66b2aac0-5bb0-484b-9cd9-3b472b28ef64", "sighting--a174a65d-e39b-46a2-bded-25899d7b54c9", "sighting--ed7044d2-365b-4057-a7c2-afccf06ee784", "sighting--a96da9de-fcb1-4c8c-8e69-103183b69908", "sighting--42e7743c-2348-45d0-b241-f47453ef8ae0", "sighting--5c8177aa-23c1-4355-a906-720490836215", "sighting--9d90e482-2e3a-4d38-8bdf-39b1ab024e2e", "sighting--c4815aba-3e14-43cd-9e9c-58c94d30d700", "sighting--e78c06a5-4d7b-425d-a550-6ac198d49e76", "sighting--56961bd0-51ad-4d59-8f9b-308ebf363f4d", "sighting--9775cba8-f48d-49a8-a580-a3ea29d42fce", "sighting--0b683516-f2d6-42e0-b63b-3e58c164bc17", "sighting--27360479-e888-458a-8029-3c103177dbc8", "sighting--445a9a26-db14-4e31-9057-ce2b4d24e24d", "sighting--47047bbd-e005-4432-ae69-6652863386cb", "sighting--124f8ae6-14c8-45ae-bc82-6a6c1ed2bc05", "sighting--0572d7eb-14b4-480f-8f0c-f1b9aa5dad60", "sighting--e3332864-348f-4aa1-bfe9-be9a99e11c0a", "sighting--154676b2-95e0-4775-89f7-da8ed86c79d9", "sighting--38aa607e-88a6-4c75-8cd1-32bcade319fa", "sighting--63746271-1a99-450a-8d97-cbd2924706a8", "sighting--2fb310ac-53d6-47f8-a631-568ed85d5a0b", "sighting--821a24de-6e2f-424e-9c4b-63b1150f172a", "sighting--ff413623-7486-426b-9500-b73881c48819", "sighting--54364540-998d-4d44-b0d8-cfb80ac647ee", "sighting--c17cc4bd-f3b1-4295-83b8-528204e150b7", "sighting--b895d943-b233-4c96-ae71-2ac621b6c9ab", "sighting--9034a2e0-929c-4590-ba4a-1cd01b052acd", "sighting--72ed35cf-216d-4cb1-b66d-ba78d8feaec9", "sighting--0fd12480-6512-418f-82fd-dfdd116507fe", "sighting--343bf208-aa5b-4c52-a403-0f1cc5efe638", "sighting--fad80858-bc2d-4667-b368-73b5cf4f2e92", "sighting--f09ecf97-ab75-41ea-add6-f1b58dd453de", "sighting--d16a3ac9-5513-42f3-ac4d-fe81837dce62", "sighting--12f92f5f-bee8-4ce7-bf02-f37a013a0d41", "sighting--8ae1efd2-c76f-4c75-b78d-29baa99c3637", "sighting--90ab1e08-105c-4975-9bc0-682b79919877", "sighting--b582435e-0bdc-4e7a-a53b-b7e4585266f2", "sighting--3e5bce10-849a-491d-a3e7-316e7ba66a57", "sighting--fa255d16-3929-4026-9ad6-337626e4c460", "sighting--97e79bb0-0d9b-4121-8271-418686e343d3", "sighting--5ab13440-7db0-413c-a773-e50110c14436", "sighting--970c7a10-634a-4327-b0d7-feed70be8888", "sighting--3f3f6856-7507-4d44-91cb-79806595d2de", "sighting--cda66b49-a845-41a2-9e91-5f8076dc16d4", "sighting--8b8b5bd1-cba3-4985-a9d4-8353d3163e02", "sighting--ddbc2bc7-6ec1-494b-9752-b9f2caf87b40", "sighting--b474551f-1bda-4970-bf11-c5f0673a450b", "sighting--f0ccd779-20c8-4827-bece-063def565fa5", "sighting--355978e0-44b6-4a86-bce4-b6bf12d10c6b", "sighting--998f3e02-1502-49e0-8d7f-5c4e223807bb", "sighting--0f0b5e72-3120-4934-9d5a-c159ea52d556", "sighting--6084fc07-c681-46ae-a134-667ca7f9b9e7", "sighting--4acfabbc-d9b8-4e12-941d-0f7bb4eac751", "sighting--967f3d00-9ccf-4d81-8a26-3eb65c78d363", "sighting--637f8246-fd85-488c-b129-6185beb1fa79", "sighting--5ed3d095-dc56-4582-a5d2-c2c716e63f40", "sighting--d52d654e-21a6-4cda-ac73-905bcbab6168", "sighting--32642cbd-6cbe-4612-96c0-d1b156304b78", "sighting--5a9bdf57-7ec8-4c27-9538-97a40866af41", "sighting--9e39cd86-467a-4adb-9d8d-0c3f96bb3b60", "sighting--6d0dbf0f-bef9-4361-a957-71629eebed66", "sighting--9eef0fb9-87f6-423e-aa3d-0a1988619e3e", "sighting--5762a73f-87bd-45fd-941a-091724a4666f", "sighting--93ed3763-c437-447d-af62-bbda63ed56c4", "sighting--75083f7b-900c-41d5-9a90-f7ec3bbc4774", "sighting--c71c4c99-4127-4d83-934d-7340587e1df6", "sighting--e2102489-d7a9-424f-821a-a9078ba416ff", "sighting--67602232-b2f3-4a7d-b14c-c5e232bbea90", "sighting--9c60e80f-56aa-4524-952d-03d0929952c1", "sighting--cae98c76-d8ec-4ebf-a2cb-b97042fdc4b6", "sighting--6d6de969-0724-4e0d-b41c-9886ce0a84c7", "sighting--458205b5-64ac-442c-bf28-d78d821a86c0", "sighting--10ac3ed1-8fae-48b0-9a4a-9bb71acf2908", "sighting--6aef9643-5516-4211-be5b-c5b67c66a447", "sighting--9c199e6c-3252-4277-a137-f608ec6a0d6a", "sighting--320369ad-0bf2-4590-9d42-908047e36868", "sighting--cbe4d68e-6a37-4d3f-8bb0-34f5cf4d9e92", "sighting--bad1f093-2f75-439a-987d-6ae74f1ec5fc", "sighting--84a5d230-d38d-46c4-a737-ab43c36d4570", "sighting--182c979a-6234-4922-b554-43159261aae1", "sighting--16ebcdc0-0f13-45b4-b3b6-bad3d6601284", "sighting--e40d09e4-9360-42bc-b693-5283769d5f2b", "sighting--17337558-33a1-4f4f-a7c5-6befbb328e40", "sighting--0758c2ca-88df-4229-b992-42fc93fa461b", "sighting--2a581415-9802-45af-b377-a6771e3b2cdc", "sighting--b17f0fb4-66cd-4e98-9f2e-85e399c359cd", "sighting--0240b792-0eb4-4457-8505-999ac8b9abd0", "sighting--89e84654-2218-4dbf-b983-1f672a10f86a", "sighting--6ec2f2c4-c7f8-4fd3-a736-d0d9244154a6", "sighting--5a525491-b2b6-4bec-8dc0-5f2caa36627e", "sighting--4a3b9786-52c1-4a18-8783-3eafefdbd137", "sighting--8574c2a8-3802-4b04-8a6b-367135615eb1", "sighting--2faebbb4-481c-432f-ac34-358e5fc80b46", "sighting--02bdf2f4-2539-4713-adee-9cc45bcbc556", "sighting--d1d8f78c-0ec3-46d9-bfec-28f1c258dd3d", "sighting--03f1adb0-1b6e-40b5-a055-d8cedeb499d4", "sighting--31bf2a55-9b2b-4604-8853-156c4a9c791b", "sighting--e8c1f9eb-9531-4c5e-aa3f-32a21b3be036", "sighting--d423ed92-3503-447f-a221-ffe8997ace9b", "sighting--189b8f0c-f5f0-4eed-b6ab-5277e64ff1e2", "sighting--553d88d9-011b-45e5-a7fd-08f50e3a4448", "sighting--0c472885-e627-4360-a019-70f04a5aeded", "sighting--08974f05-b8f9-4308-996b-7dcc2d7e8f59", "sighting--8974223d-cede-49f9-8f17-f3890166f2b7", "sighting--4ecdb7fa-9e07-46f5-b3c4-8170a1219d2f", "sighting--6bd2456b-5aa3-4188-939c-e0f085a70847", "sighting--539e7a67-3e8b-4ad2-a5a5-047f8e0ff27a", "sighting--b174de35-4ff9-47f0-9ac3-82f077be3231", "sighting--682e6bc5-7333-4c16-99e3-fa39222a2f7d", "sighting--de434119-978d-43d7-a0da-57419f410b09", "sighting--73c37b08-76dc-4bf8-a639-9f17d2e3212c", "sighting--40dccbaf-d901-4834-bd7a-309cd757c76e", "sighting--d9463a53-d19a-4486-9b6e-ca5407ac2273", "sighting--a51d1b5b-efaf-44c3-879e-653a1a941de2", "sighting--d278cdc5-d4f3-4895-8eff-9b894fdfe540", "sighting--e52ed271-3be3-47a7-8ee3-1db93c3bbebd", "sighting--6187f1f9-ddce-4cb7-90d7-c643f8185bca", "sighting--edeacb55-f716-4fbd-97e6-5912cc49537d", "sighting--d358ac2f-8d3f-4e0d-9b76-8a59c48e8fb9", "sighting--f27f2a1b-3cca-4ed1-8ddd-b988abbfee78", "sighting--eb1c6825-18d0-4fba-a642-45a64ebebf71", "sighting--62d2de35-94b6-4b66-a9af-eb23ef1742b1", "sighting--c24953d3-e3ea-4a54-891f-956ee470f17e", "sighting--27566b41-295c-4100-b37c-2ad9872c8f94", "sighting--036d3dcc-50a8-4082-81a5-171b7a33a973", "sighting--c1bfca9e-3989-48c4-a19b-2e5efc581add", "sighting--81f2d623-6de7-442f-a9ab-7801fe3adbf1", "sighting--37d3162e-65d1-49ac-8d25-ffb8210d16aa", "sighting--99d4da7e-5066-4e61-b169-f460f6bea63f", "sighting--bb0f7452-053c-446d-ab43-100b457bcf70", "sighting--0b62ee07-ee66-4ac8-a156-a7312060c6a2", "sighting--75a3632b-4759-478c-8436-6ea58c353705", "sighting--a5e52a76-87ea-41ed-9e01-a5a53d203691", "sighting--af3d5148-226a-4765-aaa1-a97e039dfc9c", "sighting--e61dfecc-db47-4b3c-b216-6adf950aec7c", "sighting--63f63ca0-42eb-4651-b1c3-9932cac65b13", "sighting--9bcd073d-262e-4a78-8a9a-75baeed2dae6", "sighting--fa03704f-0d26-45df-a330-23c07aca0bdb", "sighting--d450a733-f309-4097-b96e-b875f6b4790d", "sighting--30a49e31-4b84-4330-9d58-adb6e61b5fc7", "sighting--769ecbc4-eaad-4d7d-9db4-aea30fad2738", "sighting--9ab538e6-6e1c-4320-92fc-21117bb027ce", "sighting--7514560e-8c98-485a-b740-bf0306d52ccc", "sighting--b07f82cb-0312-4a68-b5ba-9ba31b87ce9c", "sighting--cf566230-61d6-4ea0-9a12-d131c99e0fbe", "sighting--1bc38032-a631-44d6-8277-654337d0b5a2", "sighting--8f777e60-6e8d-4a06-80af-10b37d5634fc", "sighting--d64f92ae-0d9f-40bc-9efd-55b0fb39a5d5", "sighting--331b4bd7-9a4a-4153-9808-62703458a9f4", "sighting--64eac96b-02a6-4c08-978f-d6d69409ff9d", "sighting--018bf7c1-432a-4c2d-a2f2-5d8c64f2f3a4", "sighting--a0e05196-1d7f-4802-a06e-dd8864509090", "sighting--6bd0374b-2876-4b6d-a01e-7b0c5e57e091", "sighting--8f213f71-0a87-4754-b3bd-51007d23a126", "sighting--c5118483-5530-4a97-b8ab-b9e60e84008d", "sighting--e9fbbf28-0232-4f3b-bff2-2f5b75fd6bf5", "sighting--59cd4ba3-80b4-458e-afa6-d23da530f432", "sighting--82175aae-48ad-4ca4-892a-ff1ff0f02ea2", "sighting--d570457e-c44a-479d-8e41-983dcae8b4fe", "sighting--f79321a0-e159-428c-bb63-539457ca2546", "sighting--13bebeff-db35-4ea0-886b-ffc33e587159", "sighting--4f506723-40e2-44ce-8130-53053b523b60", "sighting--4d7cd8ec-fe35-4b05-8358-16ef7f8027d2", "sighting--a02ab7a7-04c1-4a44-af0e-ff65cbfe559d", "sighting--c8fa8c7e-d728-42ff-9752-b8191153db84", "sighting--5a34f795-c5d0-4567-9bde-70841fd902fb", "sighting--ada7b0c8-5d52-42ec-b57b-310de0238535", "sighting--13d16aa5-ecda-4aca-86c6-e9533fabb9f6", "sighting--262c25a7-60a9-40df-b782-653cb2c64017", "sighting--b6e99fb7-4775-4911-9945-a829a10953af", "sighting--ec11658c-fb29-4f78-9757-1c04df6d7165", "sighting--f8c27862-16e6-46ea-96b6-47f3c92519ea", "sighting--40d034ae-9993-443a-82ac-971e3520f0c1", "sighting--e59c463f-e991-4c40-b30a-f7e9c7069c27", "sighting--c2f24e96-c74a-4bb0-b900-cc58dbe645bd", "sighting--a4a20ff6-3e0c-4f36-b550-db2586697946", "sighting--1a0a45ba-80a4-4756-832e-77e2207b3615", "sighting--588d5edc-b504-4058-9abf-39933bcc65a9", "sighting--76a92f8c-e6a5-48e3-bb11-ccd6fd9d25ff", "sighting--284220b9-31d0-4b99-8f34-305c2b06489c", "sighting--9e8ab531-226f-43f1-9076-d53bb1156d26", "sighting--d19d4e1f-eb5c-40a4-9d32-96f48914befc", "sighting--6c1b7f01-1816-411c-814f-2add4304f1f8", "sighting--1e1cb48d-f6dc-4004-b040-e044151d97e2", "sighting--b7cbbeff-a48a-4d5f-853a-bcf202ac4af7", "sighting--05cf5432-b764-4e31-a9d9-6b7cc1bac615", "sighting--436a5731-2ede-4911-932f-9c081cfb8d3a", "sighting--f00322e0-f59c-4fea-82c0-9b92648ea417", "sighting--d1dad3ae-fdcb-4fc8-bb76-43130b2524d4", "sighting--948907d4-62c4-497d-b9bb-d1dfcc4e0cb1", "sighting--4805c219-0814-495a-ac17-cdb1bc165def", "sighting--3346c454-fdfd-409f-8ed7-9154d186bb0f", "sighting--9686886f-5004-4535-8cd5-484d4db6eba4", "sighting--d4ae0a67-42df-4d9b-8462-1876b31676f9", "sighting--b06a6f2a-4b0d-45dd-a8e6-fd5bbc8258d8", "sighting--db825cc3-e14f-412a-b127-90a549d94e90", "sighting--0fd15cc0-5e49-4577-82d4-8e1e5e6982c0", "sighting--098cb848-0beb-427b-9be1-c69e1c70d72a", "sighting--c77c1f64-987f-4c76-8010-0b58e1bc09b2", "sighting--c3c6eb31-821f-443d-b4e1-364fa18f0b02", "sighting--123f82dc-e963-40d2-bac8-a47afce39b5d", "sighting--0981f0a2-92dc-491c-bed2-5cc6b4511830", "sighting--8ee8770f-9658-44e8-8a8d-a763e408c5cc", "sighting--7e7e8cd4-073a-4bba-9778-4593c08109dd", "sighting--78057032-ef5b-472a-9e9c-2e9c48e5eb94", "sighting--0f6cad90-1668-41c1-b6bb-9169c641c18a", "sighting--293e1953-84f9-4680-b4b2-151ba8fe3435", "sighting--3c4e0f79-3366-4e2d-a807-e4c5f6cbaeef", "sighting--5bcdc4fa-2cc7-4d68-bd76-5e6413e0c85e", "sighting--790ee0f1-20a9-4e96-8bec-ef7df0eb68df", "sighting--9f274117-6ae3-4aa9-93cb-7eff5d2e358b", "sighting--7d36d012-6514-4e26-86b7-b26f383d13f1", "sighting--90ec69e8-0c34-4efc-a10b-e98caee290d9", "sighting--2bfffa29-6db7-491d-bf43-362f8eff7ea7", "sighting--412288fb-d044-4d0f-b6d6-5479fcfc98c3", "sighting--36f2bc4f-db87-4d44-a895-56c30a51e57d", "sighting--a37f8fa8-2115-4278-8935-d8244c4d13b0", "sighting--d36c426a-5514-4556-8b4a-0cc9c152e44b", "sighting--b0bc5eb4-694a-40e3-ab70-ec060bd67e3d", "sighting--0a1e30d6-662b-4d31-99a5-876f3a5196dd", "sighting--87be241c-f915-4fee-9d6e-d101111b0fe3", "sighting--df2a952d-6836-47a4-b1e3-0bc270bb2c6a", "sighting--91de80d5-fd0e-452e-a4b7-dea27138b389", "sighting--435a274f-0a20-4196-8db5-cd23d6caa5d2", "sighting--deacc1d3-5490-4425-ada3-82a2469474da", "sighting--38dd2fa3-7fa4-4bfb-9ead-bf2d2a6f0607", "sighting--f64d5990-f950-4933-883c-eccb90bc8872", "sighting--fd5f84d1-7982-44da-9685-e12ef3dae22e", "sighting--7e53bdf8-7663-4b4f-8a09-fd747acafe54", "sighting--a0d8d534-e883-42ab-98a3-956d557a89ca", "sighting--b0f28e2b-c285-49cb-8c92-4e22b8afc958", "sighting--0cc3d958-2f6a-4a15-a86a-681c9f8173cd", "sighting--42ea108d-960c-4e06-9e13-01d3b41333fb", "sighting--9ec52202-40c6-4daa-bafd-506bec2bc2f3", "sighting--5ada3a5d-d4cf-4c50-89b4-36b34c07319c", "sighting--0682dc42-3ae3-4f58-9215-8ba5fec67b74", "sighting--1185d634-daac-4967-9d50-7db8b62d342b", "sighting--a21d7384-97eb-4163-aeb2-3cae5c7fb712", "sighting--85151b31-9afe-419b-9bb1-440496837ac5", "sighting--98f5e7be-57ce-4051-84d4-79b6b830833e", "sighting--91e41d9a-2378-4816-bcc9-ece6d7638b89", "sighting--7bbafb33-e787-472c-8efb-8282fa437b3a", "sighting--d63b006b-dade-4350-bb2f-3a53faef02d7", "sighting--f95f40cb-e968-45b7-8236-8368dbd3f388", "sighting--e52c12a5-055f-4dd4-bce5-84ca369672fe", "sighting--f4477a99-f676-4897-827c-0ba5b736ac0b", "sighting--4328db63-e5b0-477b-8bba-c2539af18ffb", "sighting--5e1fd013-59a9-40b1-8c2e-2c4f37c20025", "sighting--1436582b-04c6-4ae0-9339-f80451284501", "sighting--9f5aebe0-f5be-4f98-8017-7d2fcd529fbd", "sighting--8159df51-8d97-4ef7-ae43-c15e67fabdc3", "sighting--7946286a-a266-43b6-94e1-37ffb6d5e84f", "sighting--a8544388-7297-40a5-8fc4-1265fdc37a98", "sighting--db7dedc5-c967-4c03-a813-85e92ad83759", "sighting--8b8082da-6e61-4a97-a525-05cf7dabfa8d", "sighting--e49ec2a2-7eaf-4f85-ae5a-a21db93e5b3d", "sighting--c3be585c-4e21-4eec-bf89-9efc86d5c181", "sighting--c05ed0b2-e0c2-4c0c-8435-d22361aebe75", "sighting--c7309a55-85f7-4544-a60a-dd34ab38da24", "sighting--c1f7b2b5-6707-4cf7-9ca7-6d133ce7d3f0", "sighting--406d4187-c170-4e71-aad5-7076b6923da8", "sighting--1c567296-be1a-4a8b-b224-83e19c06181f", "sighting--400cac25-82ed-47ee-b649-96a7b10dcef9", "sighting--22658ce6-aea8-4f3d-ae96-e678ceb67584", "sighting--5085cea0-a344-454f-a496-b7977bb13f61", "sighting--ffffc4c4-f16e-463b-b337-08fd1050ea5f", "sighting--8f4968fd-23fc-4696-a262-b34c19806dec", "sighting--a87f2fd1-75e5-4ab0-945c-04aa810469c3", "sighting--8b971331-7838-45ea-addc-4131f9d4b4bc", "sighting--6998cd1f-2c25-41fe-b93d-8bf8ff15eab8", "sighting--3c394d22-2d00-4d62-b5e1-14c1a7f24f20", "sighting--c134efb0-3644-426e-b3a5-c821454f1091", "sighting--86b5224a-a674-46f8-893d-c39212a1c51a", "sighting--acdcfcf7-6be0-4417-907c-2c5971f07ff1", "sighting--f628d2b7-9946-424b-af72-f5dc8fd2c42e", "sighting--cbde3b55-2afc-4306-9601-a1f9fff7f5e6", "sighting--b3e70153-c6da-4506-80f0-dd92d749ae3d", "sighting--1ccb0980-82b6-4211-8f62-1b4c0712af0e", "sighting--33d3259f-f373-40a4-bab8-b8d0c5143a14", "sighting--79763fbd-11c9-49fb-aa6f-6fcd4e11b03a", "sighting--1030fe74-f2ac-4b64-bf90-c4577d08bfda", "sighting--14d63213-752d-498d-9a9d-5d46bd28d886", "sighting--fc91594e-dc04-41cf-855c-dbd1608b7290", "sighting--afd92e40-9615-44a7-ba2a-aebcdc9c89d9", "sighting--6786aea4-cc7c-4a15-99b4-52af724524ca", "sighting--ce6df2a6-23b3-405c-8a63-fd10ade98e3a", "sighting--e6188f43-0a4e-44c6-a0b4-321695bf411d", "sighting--216de697-a208-4084-af23-a85895052865", "sighting--07080e73-8709-4188-ae7f-032acbc3261a", "sighting--8bcec59a-735b-49f3-b611-6d9b03632850", "sighting--c722952b-65cd-46e9-82ad-a6202442729c", "sighting--c1b22fee-d723-4b27-8200-c97dc2d75123", "sighting--47dbf83a-27b8-45a6-a1b0-41db0b2b511f", "sighting--a3e2cc86-1bc1-4024-b40a-4deadb3dda59", "sighting--8a9ac84f-06d1-4fba-ad4f-6bf4e04bbefb", "sighting--a66c1982-b646-4385-a69d-e22c408fbcf6", "sighting--8ca93bb9-4d70-4f85-9cb6-b7c98efdabef", "sighting--b033d319-7bfb-46cb-90d1-865527f90c73", "sighting--58f3b93a-8e67-43a3-9d0d-64c0a32d4dcd", "sighting--84586fe7-09e1-4ce9-9d88-57761fe88474", "sighting--051765b0-1d52-4f92-964e-c4f6fee6a313", "sighting--81d1e6d5-f53c-47db-8bc0-47a832ae003d", "sighting--833c211b-0990-4286-a970-99fd63a51cb6", "sighting--451a37ae-dee6-4ee3-bf47-b0d66726cf3b", "sighting--0ecb3ab0-fc97-4f1c-ae21-fe55d17da76e", "sighting--63406102-e850-4609-8bf2-4bbc0c78ed13", "sighting--f02e06b7-3aeb-4623-ade2-76fe1206cba2", "sighting--28494716-6b5d-4590-bc0b-b274af122e94", "sighting--80cc70b5-8012-4715-88b2-7769e062bf4a", "sighting--3ff3f44f-92de-46dd-a667-a393ec831477", "sighting--372e1804-5022-4706-bd22-9844687cfd2d", "sighting--80f37863-0251-488c-80eb-70e5f306bbc1", "sighting--d2b82254-678b-4eec-83cd-fcbde59e3d72", "sighting--b87044b2-54cc-4669-9c9b-76ca8e5a5743", "sighting--e8160010-4b81-4b91-8e9a-375ed8819327", "sighting--d3f7302e-a26b-415b-9c10-1fefde9b8a58", "sighting--1f1e5701-8e56-4128-a57f-364d4d4c616b", "sighting--ab025ff0-2b89-4592-be1b-807b228a4263", "sighting--37c2cabd-0fb0-4088-a1d5-e083519f4fe1", "sighting--21afcf9f-32b7-43b6-83d2-dc011b5d9212", "sighting--4e1e2e19-0958-4efc-9b3e-86c4e347d614", "sighting--0e6f9d62-1ef8-46c2-bc30-8115067c2eb2", "sighting--0426ff7a-9a81-4a39-8e81-611933ec1b84", "sighting--18aea71d-c789-4ead-8750-b42323d36dbc", "sighting--c9c46050-cb45-4b8d-83c4-12864e05ebf8", "sighting--5192c6b1-1b66-4dba-ad83-3cb32dece406", "sighting--bfb9a7d1-32b7-4e1a-afa7-ed7195487f30", "sighting--cdde9e9b-b1ac-43d3-bc4b-80dd6a0d282a", "sighting--97fdfed0-85c1-480d-8530-acf722202c3d", "sighting--30155138-ef5a-4680-9fd4-93acd88e0fe6", "sighting--0c3249b0-a2a6-439c-ab0f-277823dd6dd8", "sighting--1fe48cee-e564-43e1-baf6-3f5ed4c4f735", "sighting--106f88fa-bed4-4e5a-ba1a-819b1bc0ae54", "sighting--a82f2975-58ec-4b14-902f-d671ce71391e", "sighting--6ee168f5-c25d-4079-9702-f77c8ab91e93", "sighting--cc29c847-8e42-4051-93e7-2856e35f1a74", "sighting--399e83af-9c07-4d5a-9e10-f07a7b8d1acf", "sighting--b571c2fa-8838-43e6-9cd3-aaaef8ad4032", "sighting--5e0706db-5c17-4b87-ba2a-e972b4bac4f9", "sighting--6407f497-bd84-4ee7-8276-ad2fffc2154d", "sighting--163d6d3d-69ea-4f80-81c7-58eed905b252", "sighting--48a5a795-2518-4fb7-92e2-3d72819dd689", "sighting--5f4f7f80-680e-40b9-858d-9357b9495337", "sighting--dde57a74-2817-41a5-8d64-3809006ab25b", "sighting--798e1174-dc4f-4e63-9d79-1f0f3202d5a8", "sighting--4e67e186-4632-4480-9def-6a00bec262eb", "sighting--9aca2b23-cd4b-4e5a-9e52-ab143de02984", "sighting--b3cf9d30-6fda-4f09-a6b8-d84c57861ce1", "sighting--f04093a5-3303-4a38-8cd1-df9acbe74f46", "sighting--d01cbf76-744e-474c-b34d-49bdeaaea998", "sighting--d8108127-b04c-4185-b829-dcc0dbc24788", "sighting--dd373295-8e94-4832-98e3-4096c1ecfb73", "sighting--04dd65a9-3da9-4f0c-aeff-8078873d4fc7", "sighting--8a0d365c-2412-422e-91eb-49d398584a2f", "sighting--b330b901-c34b-44cf-9f0d-6eba99b410c7", "sighting--7bce1668-1421-49aa-a2ff-ae0026a106c0", "sighting--fe457562-a842-41d7-8f31-2455da72215b", "sighting--5a7673b2-e707-4685-a443-3e285c0a3059", "sighting--2aba16fe-a7b3-4501-adc0-a97d2c9ad2be", "sighting--a1d66e21-6ddf-4dc6-b035-b6a30195222b", "sighting--db37a491-de9b-481f-b44f-a68387d2c8f0", "sighting--3bec6e75-1848-4740-b110-d2d88623686e", "sighting--c94d09d0-5d4d-4e0a-985d-2fa129cb5870", "sighting--1f8821ad-6bdc-4fae-a01c-9f76ef196d51", "sighting--e5db31d4-2b3d-4252-b8f7-cb8f25158559", "sighting--155289cb-14f2-4d30-8922-e22acdf84b24", "sighting--bd923856-34c0-4248-bb01-a34d90f6a0f2", "sighting--25071034-aceb-4f18-a2b5-133132c26c33", "sighting--fbed0a2d-0dd1-4dc5-b06d-738b2efae289", "sighting--e0db2360-7b3e-4f03-9048-1a4a931e4926", "sighting--38665ef7-2dd3-4f07-abb3-3a75be54103f", "sighting--ac522325-7c5c-402c-8b81-f8e351e20ae4", "sighting--74204e7d-a8ef-4ee4-8d29-1ba10bae952f", "sighting--d0ae62cd-929d-41ae-bfae-188d073d824f", "sighting--debf382b-0f18-414a-989b-102e8174157a", "sighting--028b88e2-7d78-448a-91d6-2c5592432662", "sighting--66c39206-6f9f-4c51-8e8b-6fdcd62a65a2", "sighting--5eb7e121-4d71-4fd3-a414-4da34c5f1352", "sighting--5f27bdc7-5925-4ce6-957e-d6aabd9db304", "sighting--d89d70b6-4b26-4e1e-9dfb-a0759c8221bc", "sighting--9296903c-d645-47a7-b73f-d5e6e6362f7e", "sighting--624251e3-20f9-4b7e-8fc9-f3cad09a7738", "sighting--021fa57b-c0fc-4593-84a3-8708d509f95a", "sighting--b55d508a-3977-44e3-8bd5-551ec80ba580", "sighting--6edc4dc2-dd3f-4bda-ba96-364e0c496f40", "sighting--87ba4179-f3b9-4ae8-a774-0379dc77ef13", "sighting--561b4aad-86dc-4749-93e3-2f9678cfb1ab", "sighting--da315c64-02c3-4832-80b2-fb8329358623", "sighting--14fc6a7f-5304-4868-8c84-38341fcb0ca1", "sighting--66c4f077-de76-4fc9-b389-d5514d270211", "sighting--647bd177-8f74-4804-bae4-707f700daa02", "sighting--039c2382-2aa1-430d-b39f-168dec9938ed", "sighting--654b0447-3b30-47c2-8410-bd59e774748b", "sighting--2246dff9-ccd9-4eec-96a0-6b69b0fc0daa", "sighting--5a33b805-839a-4a32-bb2b-8b24fe7d94b8", "sighting--9535da8f-a1bc-4204-973e-7bff1de5fdd8", "sighting--ac93e401-4c6b-4808-a6c0-7e7b280bb384", "sighting--fe518529-83f7-43c1-a675-1d4d065f54ba", "sighting--3e4a0cc4-2041-44f4-8430-61ec07a4a1a4", "sighting--32502985-ae48-4d0b-99a1-85696f3f9306", "sighting--809c03f4-cf8c-4a3e-bae5-fab0084399fc", "sighting--e586c7e7-768f-42d5-9c71-38eb47b2ac32", "sighting--0243e16d-be30-4912-b2ca-37229e188a91", "sighting--dc2b58a9-64c1-4e96-be7d-8a98f81bd57a", "sighting--b5ebaa52-0045-4e77-affc-449ff1451716", "sighting--4a9bdd0c-9186-4464-94bd-d2008188dcc2", "sighting--20b8a9de-78e5-4ed0-a7a8-cdf98c38e9fd", "sighting--8dc2475d-8fa5-48f8-9a15-f68efd5b6441", "sighting--90961862-1597-45f8-ab02-4557125bc9a5", "sighting--bbb69b85-d095-4909-b3e3-f7e61c2dcf8d", "sighting--df16b778-8ce6-4f51-ba3a-094fed6808db", "sighting--53a775a2-8fd4-4028-bd19-75eca728705b", "sighting--adb8781e-ddab-4ab9-af58-28d650d67624", "sighting--337bf015-80cd-490a-ae48-612c6838aa25", "sighting--513e8a42-c50b-4344-8abb-427d8fffef10", "sighting--5a2d5b20-c2a7-461f-b838-2c55aab3c9da", "sighting--8495467e-c583-41d6-babf-7de61fa71946", "sighting--b9e1c3f0-5b0f-4fc3-a4fa-7c09cecda121", "sighting--22dd0e76-22c6-4764-896e-cce2b385db47", "sighting--dac78b6c-d086-4a62-b0c2-c2bb05a00078", "sighting--269531a2-7aac-40ec-8a42-f28255eb491c", "sighting--50d1a68a-49c8-484c-b4e4-7a2d230b7718", "sighting--b84c0350-1506-4e79-920d-66b762681e2a", "sighting--67c0e41a-f0bd-4743-a358-4598c1bff416", "sighting--cff48b77-b5a0-4465-867b-20c79ccbcf2a", "sighting--b1c56bd9-ada3-4c32-b5c6-81d43debf5a4", "sighting--fc9c5579-03dd-4c7a-a454-7e8b2b420aee", "sighting--25808c70-784b-49e0-919a-912339ae8e4d", "sighting--8606d268-58bd-4be0-bcf5-7915621a5c99", "sighting--74dbb116-d16c-42e8-a423-bbfaef6b7347", "sighting--0aefeaee-5a12-43c4-84a8-e42aa5f32764", "sighting--0ec30c27-7aee-4c13-9c6b-0f22e2407fda", "sighting--fbb19bc9-0280-4531-945c-29e208529a90", "sighting--a482ce1b-2609-45dc-b892-490a2c8c5665", "sighting--cc3af216-97fd-4360-a799-445c23d2e601", "sighting--cafafe45-63cb-40ea-b2ec-816e8fc1591a", "sighting--4848ec26-217d-4669-8597-b2044120d444", "sighting--8ada2e0c-527d-49cd-98f4-0cbb14b4ed01", "sighting--4f78ba48-2c87-4a53-8794-99bd14d694f1", "sighting--ff042978-e45d-4537-8e4d-f6641629115b", "sighting--5ec07b63-0ce0-4b08-a88b-a47c979a5066", "sighting--542e7233-eaaa-45e2-8b4c-b43e08d3a588", "sighting--3d95ff16-6ec4-4262-9284-4cec1b8ba2dd", "sighting--754239cc-b22c-4018-9e40-def93956a405", "sighting--53d0666e-bb1d-427d-ac77-dd28db79fde2", "sighting--2b1b2010-5ecd-4333-8508-17400757f945", "sighting--99b2fb9b-2b80-4332-bf25-fd1802757147", "sighting--a654772e-c16c-4089-a1bb-72d430373607", "sighting--9938615b-afe3-44f9-9b30-47436023b145", "sighting--c297f356-5c89-47f3-b8b3-b72fef8e70af", "sighting--e0700577-c614-4b77-b607-8c60b174e381", "sighting--4f8463ef-7f9f-458b-9f6e-87750732c575", "sighting--4e425f86-3a1d-4965-9c39-ac731b32a9a4", "sighting--a057aec9-ed7a-4754-a9b7-0fec19372f42", "sighting--bc40c2fe-98ba-4e02-99be-00ba34492241", "sighting--ba94910f-9638-443b-b869-637c0506d3fb", "sighting--8f1c2f06-4f1b-4775-8e08-1b7c5beaa60c", "sighting--4ac8f2c9-1a3f-42a6-affb-d806976ef8f3", "sighting--66b0937d-357c-4b7f-9f51-9eb74d280855", "sighting--90719922-fba1-4907-b671-38183e4f4c82", "sighting--95f30e55-82a1-420a-a38f-78abfb64a826", "sighting--76b1a3cf-1ded-409a-90c3-695a5aca5729", "sighting--f5cd6d39-64da-4af8-892d-db1245511157", "sighting--7decc042-a8cd-4035-9d50-65099c7ef2fb", "sighting--998ee0f6-413f-4360-918f-9fe6b4ab102e", "sighting--d00c5e3a-9b8e-4759-8b7c-6f883f8b85f0", "sighting--73e9c34f-ae6b-475a-b28b-092c2ba03916", "sighting--b4856c72-6dd6-4bf3-8673-a38f01fdaa41", "sighting--1111f625-b400-4ff5-8b70-66d5978add20", "sighting--913e4d24-097b-4b17-872d-cd496cd2b54b", "sighting--8ad6f185-f5f0-4f25-8e05-c6c5596238bf", "sighting--c223fbb1-2393-4551-bcb3-3ac8bb6e199b", "sighting--5fd8f861-de8f-4666-8274-fc766656c949", "sighting--d9222843-b2dd-48fe-b1a8-62424e1d737b", "sighting--cfd89b97-d98c-4e9f-b018-e5df8cbe9b87", "sighting--7ea46697-3454-455c-b319-95bf12bc40db", "sighting--6c0dc4a6-f2e0-4574-84b0-5bc768202ada", "sighting--6c4f6574-38dc-4966-b11b-3f02230164a6", "sighting--3e7b0f43-0e40-4444-9ca0-774876ee1ca6", "sighting--39a9fc36-502d-42b0-9206-816da6300b8c", "sighting--74af58cb-0e7d-4b9d-bed1-1fc24b476f0d", "sighting--eaeed241-19fb-4888-af06-8b0db720be54", "sighting--be87cf67-ec25-44b5-8b28-c4f547565496", "sighting--2b9e6b6b-a41f-45f9-a91b-f8086f6d76f5", "sighting--206f15e2-2d2b-4cd2-9429-17d52df26d8b", "sighting--cc7ba133-29da-477f-ad7e-940cad3e8812", "sighting--5e6f058e-8d3b-43b7-87a7-67f5223dda26", "sighting--3e293a7f-ea9c-4978-9f16-0e05468e6ca0", "sighting--3d424216-853e-4989-b6c7-26c10e3d6645", "sighting--73e7b47a-407b-43f7-9bb5-12a1ef85f547", "sighting--8f7a05fc-ed4f-4cb7-ac04-b11e19cdfccd", "sighting--2cb222b3-8e5e-4ba8-b74a-656886516227", "sighting--70fe3c8f-876f-4ff9-9331-1b4e43ca6e2a", "sighting--89590ee2-d820-48f2-9e47-668f85c88c1f", "sighting--17991988-c351-457e-890e-0cfff8b6bad3", "sighting--48b00cce-67ee-4ab7-9f69-dd49a1f761b1", "sighting--2e4cca09-273a-49ee-8381-ae67afe8970b", "sighting--3108d6fd-e2ee-4e91-90b6-b655d121f0b6", "sighting--d6ccf7e2-7e78-43e9-950b-72caa10a48ea", "sighting--4cb7bbf5-e30f-40a1-892f-4bf7229c84a6", "sighting--a405acbf-7b63-404a-836d-5580617be20a", "sighting--76061e4c-68f5-47a4-9738-9524781c84a3", "sighting--058b2019-a7ab-49bd-9255-05fac171274e", "sighting--6970d4c9-8255-4128-8642-04578f5ab258", "sighting--63773822-2023-4397-b463-dac7f050f52b", "sighting--4c7f14cf-00fc-446c-bef5-90cf77654c4f", "sighting--ca529446-6b69-4c52-9ea2-bb65f7810793", "sighting--26461a4c-14ba-444b-8061-1ab85fd269a8", "sighting--0f70cbad-21f3-42b2-880b-7767baebb676", "sighting--0bbb6538-260b-4451-8e90-66cec6118629", "sighting--79bff8f2-eda9-43bf-8002-fb68009fbabe", "sighting--b611cbbd-78d7-4bfd-b24d-18d24ca3669b", "sighting--b3d55a83-54a6-4a81-94a0-3f7b141192a4", "sighting--228164f9-50d5-49cc-9e85-e9e1f646ecb4", "sighting--04fb2605-1626-4af1-ba29-705e28230a94", "sighting--efda5a7d-6f26-431a-ad98-2116b2ae2209", "sighting--9a33f895-f924-42f4-a8d9-03a38e7b046c", "sighting--0f112067-f7f8-45ed-a25c-11412c4c9d41", "sighting--6c4ef8ef-b7d7-4a83-be12-5a5d8b049256", "sighting--e384d7e7-9726-4294-88aa-c8e46b3a5391", "sighting--34f417d1-49ad-44bf-98ae-20e188db5420", "sighting--dba0b787-e6e1-4794-8ea5-3262a9baac3e", "sighting--982b87a1-b917-45e4-b5dd-b8b4ffffae8c", "sighting--b4785550-a550-406a-8ba2-17e32e6cb2bc", "sighting--4010a72c-4af3-448d-8043-4a3de5d9041d", "sighting--25303e2e-b135-4995-b704-04cf79aa2208", "sighting--f72579b0-6bdc-428d-a98f-bdf604d03618", "sighting--d20221ff-d35b-4b6f-b386-f7f9071ed18b", "sighting--7468ec4a-dd40-4f7b-a211-f29b408d48dd", "sighting--79d3d740-7b4b-4247-800e-e1e5f781f0e3", "sighting--7de884d5-658f-4216-983a-07036857621f", "sighting--6efdc3dd-84be-4001-992c-b049a605579d", "sighting--ac502234-e3f0-41b1-a2d4-039846fbcd07", "sighting--3179b139-53d9-4a2b-8ee1-7f43c49c8b8e", "sighting--cf5c8f2e-c284-459d-b388-8c04a59b0919", "sighting--180e6cc3-7543-4022-9af4-0a5020e9d6cc", "sighting--57d10ef5-baf7-4ed7-a0a8-86061146d6d8", "sighting--5786c830-e97e-4b3b-b285-69dae24ff1a2", "sighting--594049e3-3b42-493e-8b76-7e86b02a294a", "sighting--8b1a413a-32de-4bee-9507-b9ca264df920", "sighting--e61b4db3-ed13-40ce-9b71-ea5d5545636b", "sighting--3c46c504-2ba8-400d-96a6-ff831d2cf579", "sighting--6e8221ca-f474-4b7d-9cb9-70bc54521274", "sighting--5d25ff8f-4433-4ade-847b-35c533bfd696", "sighting--3e41017f-5a62-48d9-b910-a2e5b908a979", "sighting--42d57450-4309-4d4f-a2e4-acc8e4e3dfc9", "sighting--3b6f1932-e65a-4f57-88f1-a76abbca3305", "sighting--1dc75c34-df86-4e95-91aa-6191121d5f42", "sighting--92745791-33ff-45f6-9abe-fcff89e0b4ce", "sighting--4a9828d8-bc87-4dbb-bd38-fac93e45d23d", "sighting--344b9d21-d931-4732-99cc-a34d6bbcb1f5", "sighting--e812adcc-14de-4b08-b6aa-a683d6b3a13c", "sighting--3ef99842-d21d-4912-b7d8-eb04904d454a", "sighting--ce2256e3-57b3-40e0-b78e-78305aa67c5b", "sighting--22174915-841d-478b-85a0-85ce45b0c7fa", "sighting--7392585d-275e-4598-b25d-c7e0e219ed8a", "sighting--001e63cf-0535-496d-9bb0-87adba0c0bd4", "sighting--8b285e3b-f0d3-4273-a063-6cb90ad05858", "sighting--6590aa97-d544-4382-9459-4fa8407cd840", "sighting--53c271df-6ab9-40e6-81f8-7b7ea6865e96", "sighting--b3059651-4738-4e1f-bdfa-97b7f891123d", "sighting--16ace883-ae83-4ec4-b735-fb28636c4ff4", "sighting--7fa92284-5d12-4534-b93f-ef6b83e2108c", "sighting--71240925-5aed-495a-97dc-57c123ace4dd", "sighting--c3d5240f-161d-408a-99b8-8569863d082e", "sighting--03c2d666-301f-4ca6-afbd-999d571c94e0", "sighting--3d65a961-13c0-464d-9283-83759fc19f28", "sighting--2d1d47b1-3f94-499d-90f6-a750af82326c", "sighting--c1157c8d-0632-4fda-93bf-6dc69482ed61", "sighting--93902db7-666c-46d6-ad4e-21ce16ab731d", "sighting--ab55d07e-30d8-4f00-9b96-3a96f2b61603", "sighting--f38dcf7d-57b7-4ff4-8de5-349aef084b9f", "sighting--2c3846f2-55c8-4fea-a6c2-6fb5e0ff032a", "sighting--8cc453b6-93c4-4b33-8525-91185e5bea76", "sighting--3c0c2992-1438-463f-b005-30a0ed20325a", "sighting--337d6ae4-ae4a-4225-bdd6-781c6d3b5f8d", "sighting--1f3b54a6-8f38-455a-bee5-1c92f2563818", "sighting--62477731-13c0-479c-a3e2-db67fbc8b6ee", "sighting--30d917dd-777f-45e9-9bce-34eb9f769377", "sighting--755d1ef4-993d-4cac-9046-56e5a779b296", "sighting--7a3fba80-8376-4109-a1ce-f1272c641d8c", "sighting--0d8e8060-bf1d-4c37-929e-d6ec5af08fe5", "sighting--f0ff596b-abc8-4235-be74-e2b6b9953fb3", "sighting--5b6917f0-cca8-409d-8eec-2a713327e67e", "sighting--5d7e0ffd-8607-4080-a168-806151670f33", "sighting--f21dc152-8b17-4b08-8f2c-e859c42d22fb", "sighting--2330c626-d211-4c6f-90b5-0667dfaf3600", "sighting--cc4c43bc-b929-4054-8903-88d5d457c0f4", "sighting--cc8e8096-ea60-4582-9b8e-fe480a433304", "sighting--8a451786-497c-41f6-bf89-4010925708d8", "sighting--3e4667e3-89e6-4098-bdcb-f2327147f52b", "sighting--909ddc91-e6b0-4c1a-b64d-24650118c4f4", "sighting--93581d98-a15c-4f47-a585-0c0cf3f24790", "sighting--e722d73b-fbc0-48a5-a323-f53478e28ac7", "sighting--7212a203-d5d4-4c40-af05-3ea30dd6bfc4", "sighting--0cad846b-ed36-40fa-af58-844a28688028", "sighting--a4325c15-7703-4d25-9644-6d1025236922", "sighting--5e96b252-a584-457d-84d1-b456b059789e", "sighting--a8ad1a0c-8956-41fc-9bf8-a627b06162b9", "sighting--d15241f4-9eba-4182-9363-f336f866d4b4", "sighting--a8a0be0c-0294-44f4-9654-786c44027168", "sighting--393eff3f-3d7d-4708-9fab-b742a3bdd171", "sighting--8c9b790d-9ed7-4d25-8f66-3df1d2943ed7", "sighting--fab9ffaa-4205-4fba-812d-1b22c60a9828", "sighting--cd851db5-a0ac-4d32-8b17-27f5f576898c", "sighting--410d80a9-5e6e-4c6e-b98b-5f8a32337e4f", "sighting--cf698ee2-2bb4-44df-b418-e74d34a0cd70", "sighting--519e34d1-84b4-42c1-b7d2-8c20c385c742", "sighting--e56819e2-640f-48e1-bcf2-d564332650f4", "sighting--89a02b17-22d7-4a82-8c28-fc3e5d26df27", "sighting--f1fd9230-92fa-447d-88af-dabe4167d6ed", "sighting--808127b2-e3e8-4107-84ae-3ba20ce0b6cf", "sighting--28ddaf05-c360-4169-8b1d-afd8532c7a95", "sighting--bc62f959-dafa-49ea-9953-249fb304afd7", "sighting--28cdbab0-6b09-4e0c-81d3-47556c66d3fc", "sighting--c6c7850c-f537-4867-805f-236c87031ebb", "sighting--2e9eb862-9b81-470a-9cdd-e306b948bb3a", "sighting--da8b5fa4-38f3-4f76-8a45-48e7bcc75bc0", "sighting--72a52df2-b53e-4844-82d9-512aa302ed18", "sighting--d304c294-042e-4206-9251-cfd5f32bb17b", "sighting--f3e4aa52-9edc-4c0e-adfe-466e557f2eb1", "sighting--e9d48653-cb4c-4860-8102-8826fea38a59", "sighting--4a17b8da-4490-4799-a565-e644f4c22f80", "sighting--5b287966-67fd-4dc6-9394-366e2591ed6e", "sighting--d90ea73c-3bb8-40f0-9bfa-077af6575e31", "sighting--a6bbe919-c9a7-4f54-abf2-6d653b224be8", "sighting--02398fda-e56e-4643-af7a-005a5cb98d86", "sighting--80428bc2-41bd-4f2b-98c0-2a0cefb973b5", "sighting--193082b3-0e6b-4adf-826a-6c58354e7d07", "sighting--af405500-fe1c-4be1-b855-97db23eb4712", "sighting--b86387bf-c448-4239-b50c-64d55f016ace", "sighting--ba60f476-62b7-437c-a080-3ede321e94ce", "sighting--82b9ba3f-2c8e-47b9-977d-06d2156ba6f2", "sighting--c19757f5-4523-44d3-9894-7abd800b3a62", "sighting--1637392e-b3e5-40bd-aa36-507673964785", "sighting--1274ec65-0c55-459b-aa56-af62cfb6c5b5", "sighting--7aea4a03-63f6-47d6-883d-b31fbac777f7", "sighting--64d365b8-c3b6-4592-874b-05bc1232da9f", "sighting--6d089a36-9a04-4088-b4e7-cf5b20dd92f6", "sighting--c15c6692-6600-4a76-a477-5df166f9eaa5", "sighting--df75513d-d055-44f6-83d2-5df6e5c7a206", "sighting--cea82b50-1e22-45fd-b472-31e65608e39c", "sighting--310332d4-92ad-4314-8f35-e7fc4ced6f63", "sighting--a9d31997-10a3-400b-94c7-6aeb54e57560", "sighting--1389c7be-1e90-4513-b8a4-ae8d209a8bd4", "sighting--62d40897-bd91-4032-9525-b3d89f571985", "sighting--35a58938-ed28-40fa-902b-f5e25502137c", "sighting--29728d1c-e0e9-4791-a60e-0395ebefc484", "sighting--3493af42-75da-4776-8207-43e9e73774a5", "sighting--4446bcda-3ae3-4320-ad94-124d190109db", "sighting--6417c215-c6b8-4629-9663-b5307e24eecb", "sighting--66dc6ec4-5dcd-4a56-8e6f-f0ee085dff2b", "sighting--2fea3257-2c25-46ad-891c-64631bd7654b", "sighting--93becf8b-f9a4-490e-98b0-f6743e6297c4", "sighting--0d63bb70-c90d-43ef-b32d-f804b8d7738d", "sighting--4df0594d-f87a-4ab5-88e9-1a677ac263eb", "sighting--78c2dd85-d961-40b5-ae2c-89dda6756a98", "sighting--64043acd-aa12-4271-9a5e-d9617f158278", "sighting--17b00919-f61d-45f0-8ba3-e788ad0bf172", "sighting--20e4d931-c535-409a-913d-0a4f56307496", "sighting--62150658-c422-4472-83b9-3ae2f04b22c5", "sighting--676b5fe4-42e2-413d-94b2-4f5ef758a956", "sighting--25f2968d-46f4-41d9-a206-9a682939435c", "sighting--1dd77efe-33f3-4c3b-a7d7-3d265fc36432", "sighting--55d3f5dd-6796-4f18-baee-039f14eebe56", "sighting--4cc4ce95-1d4f-4b8a-9c6e-18ea6358e95b", "sighting--780daed0-8275-4838-9f0a-8ded97f24261", "sighting--e9ca1168-06b8-460e-8147-455c023e2402", "sighting--70129fd9-6a18-4531-a961-abf93da67335", "sighting--7d4b7a61-841f-471d-8211-9746598c968b", "sighting--d1f95480-b273-4454-8f41-b7eb98f19a29", "sighting--a0d58892-59ed-4697-8660-d398c6e2677b", "sighting--0e2bd24e-9ce2-4765-8f10-c93744221777", "sighting--b95c3390-06d2-451d-8fd0-66f194b9faaa", "sighting--5628b0bc-aab8-482d-8c38-0b3f27cc97d2", "sighting--0189d3d1-c1cc-4722-bb36-3abd7c6551d6", "sighting--4d2cf2db-02a2-41c7-80c3-9699d023c53a", "sighting--a4ed3eec-2e3c-4166-a335-abdaab282b62", "sighting--ac90c142-509b-436c-9496-207f6f814613", "sighting--9a37a259-10bb-409e-8dde-620b4dddb341", "sighting--f16a1154-d6fa-430b-9ff4-dd50482d6bc5", "sighting--f8e16769-5b8f-4313-93da-05bdffcdae58", "sighting--cbbed88d-b9df-4ff0-b86e-4ba20c6c702c", "sighting--a5ad1201-4628-476c-8e6e-762f0a422990", "sighting--1eeb19fb-0461-4f1e-97ed-8cb543c17914", "sighting--367a52ee-276b-4737-b63a-44a31ec91fb5", "sighting--2631fb47-59b5-4677-9292-9ae94d522e7f", "sighting--0f895aaa-b560-4a38-ba4c-e6d057acc8f5", "sighting--91bc4c30-cc13-470a-86bd-d5190f3e78a3", "sighting--055e0cf4-7332-4ce5-a891-915318b7dbd9", "sighting--0a356c1d-11ac-4515-8624-860c26a228f4", "sighting--f66e419c-aea1-46b2-a6ae-e8f738c685d3", "sighting--a96352b5-69c2-46d0-83c4-855cc1ff2eef", "sighting--b0f42ff1-667b-4ef6-ba84-e12ccfb2261f"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-05-28T11:00:02.453Z", "modified": "2026-05-28T11:00:02.453Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}